Enter any domain and optional selector to look up and validate its DKIM record. Check key type, size, and configuration instantly.
DKIM (DomainKeys Identified Mail) is an email authentication method that adds a cryptographic signature to outgoing emails. The receiving server looks up the public key in DNS to verify the signature wasn't tampered with.
DKIM survives email forwarding (unlike SPF), making it critical for deliverability. Combined with DMARC, DKIM ensures recipients can trust that emails actually came from your domain.
Unlike SPF, DKIM signatures travel with the email and remain valid even after forwarding — as long as the message body and signed headers aren't modified. This makes DKIM the most reliable authentication method for forwarded mail.
ARC-Relay preserves DKIM by adding cryptographic ARC (Authenticated Received Chain) seals that vouch for the original DKIM pass, so Gmail, Outlook, ProtonMail, and Yahoo trust the forwarded email even if minor modifications occur.
selector._domainkey.yourdomain.com. Common selectors include "google" (Google Workspace), "selector1" and "selector2" (Microsoft 365), and "default". Each selector points to a different public key in your DNS.
s= tag contains the selector. For example, s=google means the selector is "google".
k=ed25519) which are smaller but provide equivalent security. Major providers like Google and Microsoft use 2048-bit RSA.
t=y flag indicates the domain is testing DKIM. Receiving servers may treat DKIM failures more leniently for testing domains. Remove the t=y flag once you've confirmed DKIM signing is working correctly. Leaving it on long-term provides weaker verification.
ARC-Relay adds cryptographic ARC seals so forwarded emails pass authentication at Gmail, Outlook, and ProtonMail.
Start free