DKIM Record Builder & Checker
Build a DKIM TXT record from a public key your ESP has generated. Check existing DKIM records for any selector on any domain via DNS-over-HTTPS. Links to setup docs for major providers.
Email Deliverability Intelligence
DKIM is cryptographic: the private key stays with your ESP, the public key lives in DNS.
You don't invent DKIM keys yourself. Your email service (Google, Microsoft, SendGrid, etc.) generates a key pair and gives you a selector + the public key. This tool helps you format and verify the TXT record. For checking, enter the selector and domain: we query the
<selector>._domainkey.<domain> TXT record live.
Check existing DKIM
Build DKIM record
Generated TXT record
TXT record at
selector._domainkey.yoursite.comSetup links for major providers
Next steps
DKIM is the "signing" piece. SPF is the "where from" piece. DMARC ties them together.
All three are needed for Google and Yahoo's bulk sender requirements.
Frequently asked questions
What is DKIM?
DomainKeys Identified Mail. A cryptographic signature on outbound emails that proves the message wasn't altered. Pairs with SPF + DMARC.
How does DKIM work?
Your ESP signs the email with a private key. The matching public key sits in your DNS as a TXT record. Receivers verify the signature.
What is a DKIM selector?
A name identifying which key was used. Multiple keys allowed per domain (one per ESP). Record lives at
selector._domainkey.yourdomain.com.What key length should I use?
2048-bit RSA is the modern standard. Some older DNS systems limit TXT record size: split into multiple strings if needed.
Does the generator create private keys?
No. ESPs generate the key pair and give you the public key to publish. The tool helps you format and publish correctly.
What does a DKIM record look like?
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ.... Long base64 public key.How do I rotate DKIM keys?
Publish new selector, update ESP to sign with new key, wait for propagation, remove old selector. Monthly to quarterly rotation is best practice.
What happens if DKIM fails?
Depends on DMARC policy. Without DMARC: receiver's discretion. With DMARC p=reject: email rejected.
Can I have multiple DKIM selectors active?
Yes, one per ESP. Each ESP signs with its own key; receivers check whichever one matches.
Does DKIM protect against replay attacks?
Not fully. DKIM proves the message came from the signing domain and wasn't tampered. Replay (re-sending a valid signed message) is a separate problem.
How to check my DKIM?
Send a test email, inspect headers for
Authentication-Results: dkim=pass. The tool's checker validates the DNS side.Free · no account
SEORCE for Chrome, Edge and Firefox
Audits the page you are on: headings, meta tags, schema, indexability, and whether AI crawlers can read it. Export the result as a PDF. Free, with no account.
It audits one page at a time and does not track AI answers. About the extension
Traffic from search and AI
See which visits came from search and AI.
SEORCE Web Analytics runs from one script tag, with Google Search Console connected. It shows visits from every AI source, from search and from campaigns, and it is free on every plan.
3,000+ users · Free forever plan, no card needed