Free email-authentication toolkit
Enter a domain and an optional selector to fetch its DKIM public key over DNS-over-HTTPS. Leave the selector blank and we automatically probe 30 common selectors — Google Workspace, Mailchimp, ProtonMail and more — returning every key we find. No signup, no backend: everything runs right here in your browser.
Enter a domain to look up its DKIM key. Leave Selector blank to auto-discover all common selectors for the domain.
The basics, briefly
DKIM (DomainKeys Identified Mail) lets a sending mail server cryptographically sign each message. The signature is verified against a public key published as a DNS TXT record at selector._domainkey.yourdomain.com. A valid signature proves the message was not altered in transit and that the claimed domain authorised it — which is a required ingredient for DMARC alignment. Learn more in our What is DKIM? guide.
Your email provider assigns the selector — it is usually named after the provider (google, selector1, pm for Postmark, fm1 for Fastmail, etc.). The easiest way to find it is to send a test email to yourself and view the raw headers: look for a DKIM-Signature: header containing s=<selector>. Alternatively, just leave the Selector field blank above — we probe 30 common selectors automatically.
DMARC passes a message if either SPF or DKIM aligns with the From: domain. In practice, SPF breaks on forwarded mail (the sending IP changes), so DKIM is the more reliable of the two. Without a published DKIM key your domain relies entirely on SPF for DMARC alignment — meaning any forwarded message will fail. Publishing DKIM for every sending service dramatically improves your deliverability and makes moving to p=reject far safer.