Validate DKIM selectors and public keys on any domain. Leave the selector blank to auto-discover ESP-default selectors.
DKIM (DomainKeys Identified Mail) is a cryptographic signature your sending server adds to every email header. The signature is generated using a private key that only your server has; the corresponding public key is published in DNS at <selector>._domainkey.<your-domain>. When mail arrives, receiving servers fetch the public key and verify the signature - proving (a) the message really came from your domain, and (b) it was not modified in transit.
Unlike SPF, DKIM survives email forwarding because the signature lives in the email headers, not the sending IP.
Each sending service uses its own DKIM selector. This lets you rotate keys without breaking signing - publish a new selector with a new key, switch your ESP to use it, then retire the old selector. Most ESPs use predictable selector names:
If you don't know your selector, leave the field blank - this tool auto-tries 24 common selectors.
Open any email you have sent (in Gmail: three dots > "Show original"). Find the DKIM-Signature: header. The s= tag is your selector. Example:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yourdomain.com;
s=selector1; h=from:to:subject:date; bh=...; b=...
Our full SPF + DKIM + DMARC walkthrough covers multi-provider DKIM, key rotation, and the alignment rules that make all three actually work together.
Read the guideA label identifying which DKIM key to use for verification. Published in DNS at <selector>._domainkey.<domain>. Each sending service uses its own selector so you can sign mail from multiple platforms with different keys.
Common causes: (1) The selector in your DNS does not match what your ESP signs with - copy-paste exactly. (2) The public key is corrupt - re-publish from your ESP. (3) The DKIM record was published as multiple TXT entries and the DNS provider concatenated them wrong - verify with this tool. (4) Headers being modified in transit by a mailing-list or forwarder breaking the signature hash.
Yes, and you should. Each sending service gets its own selector. This lets you rotate one service's key without affecting others. The DKIM-Signature header tells receivers which selector to look up - there is no conflict.
Annually as best practice. Most ESPs offer one-click rotation. Old DKIM keys (1024-bit, multi-year-old) become weaker against ongoing cryptographic advances. Set a yearly calendar reminder.