DKIM Lookup Guide: How to Check Selectors and Validate Signatures

DKIM lookup is the process of checking a domain's DKIM selector records in DNS and confirming that real messages are being signed with the expected selector and domain alignment.

Start with the selector in a received email. You'll use it to find the public key, then check whether the receiver could verify the signature.

Quick answer

DKIM lookup should confirm:

• the selector exists in DNS
• the public key record is valid
• the sending platform is using the expected selector
• real messages show the expected DKIM result in headers

How DKIM lookup works

A DKIM record is published at:

<selector>._domainkey.<domain>

When a message is sent, the headers typically include a selector in the s= field and a signing domain in the d= field. The receiver uses those values to locate the DKIM public key and verify the signature.

That means a DKIM lookup workflow needs both:

• DNS visibility
• message-level evidence

What a selector is

A selector is a prefix that identifies which public key should be used to validate a signature.

Selectors help teams:

• rotate keys safely
• separate environments or platforms
• move between providers without one risky cutover

If the provider signs with selector mail2026, your DNS must publish mail2026._domainkey.example.com.

Example DKIM lookup record

The DNS record commonly looks like this:

mail2026._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."

What to inspect:

• v=DKIM1 confirms the record type
• k= identifies the key type when present
• p= contains the public key data

If p= is empty or malformed, the lookup may succeed at the DNS layer while signature validation still fails.

Step-by-step DKIM lookup workflow

1. Capture the selector from the provider config or a real email header.
2. Query the selector in DNS.
3. Confirm the TXT record format is valid.
4. Send a real test email.
5. Inspect headers and confirm the message shows the expected selector and result.
6. Review DMARC alignment if the From domain must enforce policy.

For the DNS check itself, use DKIM checker.

How to validate a real signed message

A DNS lookup alone is not enough. Also inspect the delivered message.

Useful fields include:

• DKIM-Signature
• selector in s=
• signing domain in d=
• authentication summary in Authentication-Results

Use Email header analyzer when you need a faster read of those fields.

Example header fields to inspect

In a real message header, you will often see something like:

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=mail2026; ...
Authentication-Results: ... dkim=pass header.d=example.com ...

This lets you verify three things quickly:

• the signing domain in d=
• the selector in s=
• the receiver's final result in Authentication-Results

Common DKIM lookup failures

Selector does not exist

The sender references a selector that was never published or was removed too early during rotation.

Wrong selector in provider config

The DNS record exists, but the sending platform signs with a different selector than expected.

DNS propagation lag

The key was updated in the sending platform before the DNS change was fully visible.

Split or malformed TXT values

The record is present, but formatting errors make the key unusable.

Alignment mismatch

A DKIM signature can pass while its signing domain doesn't align with the visible From domain. That pass doesn't satisfy DMARC alignment.

DKIM lookup and key rotation

Rotation is where many DKIM problems begin.

Safer rotation pattern:

1. publish the new selector in DNS
2. wait for propagation
3. switch the sender to the new selector
4. validate new messages
5. keep the old selector active until queues drain
6. remove the old selector only after confirmation

That sequence avoids the most common "messages suddenly lost DKIM pass" incident.

DKIM troubleshooting table

Problem	Likely root cause	Fastest check
dkim=fail after provider switch	Selector mismatch	Compare provider selector with DNS
Record exists but mail still fails	Header uses different s= value	Inspect DKIM-Signature header
Intermittent failures	Rotation or propagation overlap	Check old and new selectors together
DMARC fails while DKIM passes	Alignment mismatch	Compare header.d with visible From domain

Use DKIM lookup with broader auth checks

DKIM should be evaluated alongside:

• SPF verification guide
• DMARC explained
• DMARC policy guide
• DMARC monitoring

Helpful tools

• DKIM checker
• DKIM record generator
• Email header analyzer
• Email deliverability test

FAQ

What is DKIM lookup?

It is the process of checking a selector's DKIM record in DNS and confirming that real messages are signed with the expected selector and domain.

What is a DKIM selector?

It is the prefix used to locate the DKIM public key for a domain.

Is a DKIM lookup enough to prove mail is healthy?

No. You should also validate a real message and review SPF and DMARC alignment.

What should I do if DKIM suddenly fails?

Check the active selector, confirm the DNS record exists and propagated correctly, and inspect whether the sender configuration changed during rotation or provider migration.