DKIM Lookup
Fetch a DKIM public key from DNS by selector and domain. Detects revoked keys and parses tags like version, key type, and flags.
Look up a DKIM public key
Queries
Common selectors: google (Google Workspace), selector1/selector2 (Microsoft 365), k1/s1 (Mailchimp), mandrill.
About DKIM
DKIM (DomainKeys Identified Mail) lets a sender sign outbound mail with a private key whose public half lives in DNS. Receivers fetch the public key and verify the signature. If it matches, the message is authenticated as coming from the domain that owns the selector.
The public key lives at a DNS name of the form:
<selector>._domainkey.<domain>
Different providers use different selectors — you can’t browse them. Common ones:
| Provider | Selector(s) |
|---|---|
| Google Workspace | google |
| Microsoft 365 | selector1, selector2 |
| Mailchimp / Mandrill | k1, k2, mandrill |
| SendGrid | s1, s2 |
| Amazon SES | rotated per-user; check the SES console |
| Postmark | 20150623 (common), or custom |
Revocation
A DKIM record with an empty p= tag is a revocation — the selector existed but the
key has been retired. Mail signed with the old private key will fail verification.
Privacy
Lookup runs client-side against Google Public DNS over HTTPS.