Verify a DKIM selector's public key

Mail administrators can run this before an important send or after a DKIM failure to make sure the correct selector is published.

Confirm that a DKIM selector exposes the expected public key and get the details needed to resolve a failing email signature quickly.

How to use

Find the DKIM selector used by the sending domain, usually visible in the signature header of an email.
Enter the selector and the domain in the provided field, keeping the spelling exact.
Launch the test so the DNS query runs and the published public key is looked up.
Read the result to see whether the DKIM record exists and whether the key matches what you expect.
If needed, clear the field and try again with another selector or domain.

Example

An important message fails DKIM authentication. You note the selector in the message header, then test it against the sending domain to confirm that the published public key is the one used by the outgoing mail.

Limits and formats

The check does not sign emails and does not fix a failing signature automatically.
It relies on public DNS, so a recent record may not appear immediately because of propagation.
A typo in the selector or domain gives a misleading result, so verify both values.
The test examines the published public key, not the private key that stays secret with the sender.

Where processing happens

The selector and domain you enter are sent to the YOORfree server, which queries public DNS itself and returns the result. No file is uploaded; only the request needed to verify the DKIM key is performed. This keeps the check focused on the selector you are investigating.

Frequently asked questions

Where can I find the selector to enter?

The selector usually appears in the DKIM-Signature header of an email, shown as s= followed by a name. You can also ask your sending provider if you cannot inspect a message.

What does an empty result mean?

It often means no DKIM record was found for that selector and domain. Check the spelling, the parent domain, and how recently the record was published before assuming there is a fault.

Can this test prove that an email is authentic?

No, it only checks the public key published for a selector. Full authenticity also depends on the message signature, domain alignment, and the other email authentication checks.