Check your DKIM record

Enter a domain (e.g. dmarced.eu) and a selector to run the check.

Common selectors include

• google for Google Workspace, 
• selector1 and selector2 for Microsoft 365, and 
• k1 for several marketing platforms.

It is common for each of your sending providers to have one or more DKIM key pairs to sign outgoing mail. For every outgoing mail, they choose one of their private keys to create the signature and add the domain and selector as references to it. This allows receiving providers to retrieve the matching public key from DNS to verify the signature.

Common selectors include google for Google Workspace, selector1 and selector2 for Microsoft 365, and k1 for several marketing platforms.

If you have access to your domain's DNS, it's easy to spot DKIM selectors: Assuming example.com wants to publish a DKIM key with selector test, they would do so with a DNS TXT record located at test._domainkey.example.com.

Alternatively, you may view the source of an email (through the right click menu or through a menu option like "Show original") to find a DKIM selector that was used in one of the DKIM signature headers. Search for DKIM-Signature: . If you find such headers, the selector is referenced in the s= parameter.

This check tells you whether a valid public key is correctly published in DNS.

Whether a given message passed DKIM is decided by the receiving provider when it arrives.

To check whether DKIM passed for one particular message you have in your inbox, view its source (through the right click menu or through a menu option like "Show original"), and search for Authentication-Results. Inside of it, look for something like dkim=pass.

Obviously, this method only lets you check messages you have direct access to, which you don't for most outgoing mail. DMARC closes this observability gap by allowing you to get feedback from receiving providers on DKIM verification results via daily structured reports.