DKIM Record CheckerVerify your DKIM public key TXT record is live across global DNS resolvers
- 7 independent networks
- Records + DNS flags
- No ads, no sign-up
Independent networks
7 public DNS networks, queried in parallel
Every test query is answered by these unaffiliated resolvers on separate networks and infrastructure. When they agree, you can trust the result.
- 8.8.8.8
Google Public DNS
Google LLC · North America
- 1.1.1.1
Cloudflare
Cloudflare, Inc. · Global Anycast
- 94.140.14.14
AdGuard DNS
AdGuard Software Ltd. · Europe
- 45.90.28.0
NextDNS
NextDNS, Inc. · Global Anycast
- 185.222.222.222
DNS.SB
xTom / Layer0 · Europe
- 223.5.5.5
Alibaba DNS
Alibaba Cloud · Asia
- 119.29.29.29
DNSPod
Tencent Cloud · Asia
How it works
A test query for flag propagation check, done right
Most checkers query a single resolver or a set of geographically labelled servers behind the same anycast network. isPropagated queries genuinely independent DNS operators and compares both their records and their response flags.
Enter a domain and run the test query
Type any domain, pick a record type (A, AAAA, CNAME, MX, TXT, NS and more), then run a single test query that fans out to every network at once.
We query independent global networks
Instead of asking one resolver, we ask several unaffiliated public DNS networks in parallel — across North America, Europe and Asia — so no single cache can mislead you.
Compare records and DNS flags
Each network returns its answer plus the DNS response flags (AD, CD, RA, RD, TC). We check that both the records and the flags agree before calling a domain propagated.
Read the propagation verdict
A clear consensus score shows how many networks resolved the record and whether their answers match — so you know the moment a change is live everywhere.
What is a DKIM record and how does propagation affect email delivery?
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email. Your mail server signs each message with a private key; the corresponding public key is published in DNS as a TXT record at the name {selector}._domainkey.yourdomain.com. Receiving mail servers look up the DKIM public key in DNS, verify the signature, and use the result in spam and authentication decisions.
DKIM propagation is critical because until the public key has propagated to all global resolvers, receiving servers cannot verify your DKIM signatures. Messages may arrive unsigned from the receiver's perspective, increasing the chance they are treated as spam — especially if your DMARC policy requires DKIM alignment.
Unlike SPF, DKIM records live on a subdomain specific to each sending service and selector. Google Workspace uses the "google" selector (google._domainkey.example.com); Microsoft 365 uses "selector1" and "selector2". Each sending service has its own DKIM key and selector, so you may need to check multiple DKIM records.
How to find and check your DKIM record
Enter your domain in the input field and click the DKIM quick button. The tool will pre-fill the default selector prefix — edit it to match your actual selector (e.g., "google", "selector1", "k1") before running. The query checks the TXT record at {selector}._domainkey.yourdomain.com across all 7 resolvers.
The DKIM TXT record value starts with "v=DKIM1; k=rsa; p=..." where p= contains the Base64-encoded public key. When all resolvers return the same key value, DKIM is live globally and your signatures can be verified.
FAQ
Common questions about dkim record checker
How do I find my DKIM selector?
The selector is provided by your email service provider. For Google Workspace it is "google"; for Microsoft 365 it is "selector1" and "selector2"; for Mailchimp it is typically "k1" or "k2"; for SendGrid it is a custom value you configure. Check your email provider's DNS setup documentation for the exact selector.
How long does DKIM propagation take?
DKIM records are TXT records and propagate on their TTL. Most providers default to 3600 seconds (1 hour). After publishing the DKIM key, wait one TTL cycle and then verify with this checker before testing email delivery.
Why does my DKIM record show p= empty or missing?
A DKIM record with an empty p= value (p=) is a revoked key — it intentionally signals that DKIM signing is disabled for that selector. If you see this unexpectedly, your email provider may have published a revocation record. Generate a new DKIM key pair through your email service and publish the new public key.
Can I have multiple DKIM records on the same domain?
Yes. Because each DKIM record lives on a unique {selector}._domainkey subdomain, you can have unlimited DKIM records for different sending services without conflict. Google's "google._domainkey" and Mailchimp's "k1._domainkey" coexist on the same domain independently.
What does it mean if DKIM propagated but email still fails DKIM?
DKIM failures after propagation usually indicate a configuration mismatch: the selector used to sign the message does not match the selector in DNS, the private key used by the mail server does not match the public key published, or the message was modified in transit (which breaks the signature). Check your email provider's DKIM configuration matches the DNS record exactly.