Rotating a signing key
Check publication for the new selector while preserving the old selector as required by your mail service.
DNS authentication diagnostic
DKIM record checker
Enter a domain and DKIM selector to look up the public key record at selector._domainkey.domain.
What is a DKIM selector?
DKIM records are stored beneath a selector-specific DNS name. For example, a selector named google on example.com is published at google._domainkey.example.com. The selector is normally visible in the DKIM-Signature header of a signed email.
What this checker does
EmailValidly performs a DNS TXT lookup for the exact selector and domain you provide. It reports the published record if one is available. It does not infer or brute-force selectors.
Put the result to work
Use the selector from the sender’s actual configuration
A DKIM public record is published under a selector-specific DNS name. You need both the signing domain and selector. The lookup checks publication, not the cryptographic signature on a message.
Find d= and s=
Read the signing domain and selector from a DKIM-Signature header or your provider’s setup page.
Look up that pair
The queried name is selector._domainkey.domain. A guessed selector can return nothing even when another selector works.
Read publication findings
An empty public-key tag can indicate revocation. Validate a real message separately.
Worked examples
What the evidence tells you
Illustrative scenarios, not live results for the addresses or records shown. Open a scenario to see the next action.
01s=mail2026; d=example.com
Selector-specific query
The lookup name is mail2026._domainkey.example.com.
Next action Enter mail2026 and example.com separately.
02p= is empty
Revoked key indication
The published record has no public key material.
Next action Confirm whether the selector was retired.
03No record for guessed selector
No evidence for that name
The domain may use a different selector.
Next action Copy the selector from an actual signature.
Use it with a purpose
Where this tool fits
Investigating DKIM failures
Rule out an incorrect selector or missing record before investigating message modification.
Before you decide
Questions about this tool
Can the tool discover every selector?
No. DNS does not offer a general list of all DKIM selectors.
Does a found record mean a signature is valid?
No. Signature verification also needs the message, signature fields and canonicalisation rules.
Should I paste a private signing key?
No. This form only needs a domain and selector.
