Enter a domain and DKIM selector to retrieve the published key. Use the d= and s= values from a message’s DKIM-Signature header.
The lookup queries selector._domainkey.domain. A TXT answer can contain the public signing key, or an empty p= value can indicate a revoked key.
Selectors are chosen by the sender and can change during key rotation. Missing a guessed selector does not mean the domain lacks DKIM.
A published public key is one prerequisite for DKIM. Verifying a signature also requires the message, signed headers, body hash and signature parameters.
Providers may use CNAME delegation. The DNS resolver can follow that chain; the report shows the returned TXT answer, not an independent cryptographic validation.
Open the original email headers and locate DKIM-Signature. The s= tag is the selector and d= is the signing domain.
No. A sender needs a matching private key. Get DKIM records from your email service rather than generating an unrelated public key.