Look up a domain's DKIM keys. Enter the selector if you know it, or leave it empty to try the selectors common providers use.
Examples:
How to Use
The domain in the d= tag of the DKIM-Signature, usually your email domain.
The s= value from a message's DKIM-Signature header. Leave empty to search common selectors.
Each key found is shown with its size; SPF and DMARC are checked too.
Email Authentication
DKIM signs each outgoing message with a private key held by your mail server. The matching public key sits in DNS at selector._domainkey.yourdomain. The receiver fetches it and checks the signature, which proves the message came through a server you trust and was not changed on the way.
The selector lets a domain have several keys at once: one per provider, or a new one during a key change. That is why you need the selector to find a key; DNS has no way to list them all.
Open any email you sent, view the original or the full headers, and find the DKIM-Signature header. The s= tag is the selector and d= is the domain. Google Workspace uses google, Microsoft 365 uses selector1 and selector2, and many hosts use default.
Use 2048-bit RSA keys. 1024-bit keys still validate but are considered weak, and keys below that are rejected by many receivers. An empty p= means the key has been revoked.
Free Tools
Frabs spots outbound spam from any VM within seconds and stops it, before your IPs end up on a blocklist.