How this check works
We query the supplied selector under _domainkey and inspect the returned public key. A revoked, malformed or missing key at that exact selector needs investigation. A valid key still requires a real signed message to verify end-to-end authentication.
Find the selector in an email
Open the original message headers and look for DKIM-Signature. The s= value is the selector; the d= value is the signing domain. Use those values here, which may differ from the visible sender address.
A key is not a signature test
This tool checks the published DNS key, including common RSA and Ed25519 key formats. To test signing and alignment, send a message and inspect its Authentication-Results header at the receiving provider.
Common questions
Does an unknown result mean DKIM is missing?
No. DKIM cannot be conclusively tested without knowing the selector. Providers can use arbitrary selectors, so guessing a short list is not reliable.
Why does an old selector no longer work?
Providers rotate signing keys. Check a recent signed message or the provider's current domain settings instead of reusing an old selector.