DKIM record checker
Look up a domain’s DKIM public key by selector, check that it is active, and see what every tag in the record does.
How DKIM signing works
DKIM proves your email was sent by your domain and wasn't altered in transit.
Cryptographic signature
Your sending server signs each email using a private key. The corresponding public key is published in DNS. Receiving servers verify the signature to confirm authenticity.
Selector system
Each DKIM key is identified by a selector. You can have multiple selectors (and keys) per domain, allowing key rotation and multiple sending providers at the same time.
Tamper detection
The DKIM signature covers specific email headers and the body. If the email is modified in transit, the signature breaks and DKIM fails — protecting against content manipulation.
Key rotation
Best practice is to rotate DKIM keys annually. Publish the new key under a different selector, update your sending infrastructure, then revoke the old key by setting p= to empty.
DKIM alone is not enough
Like SPF, DKIM authentication alone doesn't protect the visible From header. You need DMARC to enforce authentication policies and protect against spoofing.
2048-bit RSA minimum
1024-bit RSA keys are considered insecure. Use at least 2048-bit RSA or switch to Ed25519, which provides equivalent security with much smaller keys.
More free tools
- SPF checkerLook up and validate a domain’s SPF record.
- DMARC checkerCheck a DMARC policy and how close it is to enforcement.
- MX record checkerSee which servers receive mail for a domain.
- Email headers analyzerTrace a message’s route and authentication results.
- Spam checkerTest a subject and body for spam triggers.
- Email verificationCheck an address for typos, MX records and disposable domains.
- Markdown to emailTurn rich text into email-safe HTML.
Frequently asked questions
Sign every email. Reach the inbox.
Plunk configures DKIM signing automatically and guides you through setting up SPF and DMARC for your domain.