DKIM Record Checker Online — Verify DKIM Records Free
CodexFuse Team · 2026-10-28T15:05:01.256Z · 9 min read min read
Use a free DKIM record checker to verify your domain's DKIM DNS record, spot selector mistakes and fix email spoofing risks fast.
A DKIM record checker looks up the public DKIM key your domain publishes in DNS and tells you whether receiving mail servers can actually use it to verify your messages. If the record is missing, mistyped, or published under the wrong selector, your mail can land in spam — or be rejected outright — even when everything else about your setup looks fine.
That is why this check belongs near the top of any email troubleshooting list. It takes a minute, it costs nothing, and it answers a question guessing cannot: is the outside world seeing the DKIM record you think you published?
What does a DKIM record checker actually check?
A DKIM record checker queries DNS for the DKIM TXT record linked to your domain and selector, then analyses whether the record is present, correctly formatted, and usable for verifying signed mail. It confirms what the public internet can see — not what your mail server intends to send.
DKIM works through a key pair. Your sending server signs outgoing mail with a private key that never leaves your system. The matching public key sits in DNS as a TXT record. A receiving server fetches that public key, checks the signature, and decides whether the message really came from your domain unchanged.
When that chain breaks, the cause is usually mundane: a selector typed differently in DNS than in the mail system, an old record left behind after key rotation, or a TXT value pasted with a stray space. The checker surfaces those problems in plain sight.
Why a missing DKIM record hurts more than most owners expect
Gmail, Microsoft 365, and corporate filters weigh authentication heavily, and a domain with no working DKIM looks easier to impersonate.
- Deliverability drops quietly: invoices, quotes, and password resets drift into spam folders while the sender assumes they were read.
- Impersonation gets easier: without a verifiable signature, a spoofed message from your domain is harder for receivers — and customers — to distinguish from the real thing.
- Reputation damage compounds: repeated authentication failures can drag down how receivers treat your whole domain, not just one campaign.
- Support tickets multiply: “I never got your email” becomes a recurring conversation instead of a one-off glitch.
DKIM alone does not guarantee inbox placement — content and sending history still matter. But a broken record is a self-inflicted handicap, and one of the cheapest to remove.
A passing DKIM check does not mean your mail is fully authenticated. DKIM proves the message was signed by a key for a domain — it does not, on its own, prove that domain matches the address your customers see in the From field. That alignment job belongs to DMARC, covered below.
A worked example: the café whose order confirmations vanished
Harbour & Bean is a fictional coastal café, domain harbourandbean.com. Its website orders arrived fine, but confirmation emails kept missing customers — and nobody had changed providers.
Running a check told a different story. Here is the sequence, step by step:
- First check, wrong selector: the café checked harbourandbean.com with the selector its old mail setup had used. No DKIM record was found.
- Second check, current selector: using the selector from its current mail provider, the checker found a TXT record — but the analysis flagged a formatting problem where the key had been split across lines incorrectly.
- The fix: the DNS record was republished as one clean TXT value with the correct selector, and the old, unused selector record was removed to avoid confusion.
- Recheck after propagation: a repeat check a few hours later showed a valid, readable record, and order confirmations started reaching inboxes again.
The published record and the sending setup had simply drifted apart since setup day. A two-minute check would have caught that drift months earlier.
| Checker result | What it usually means | What to do next |
|---|---|---|
| No record found | Nothing is published under that selector, or the selector is wrong | Confirm the selector with your mail provider, then check again |
| Record found, invalid format | The TXT value is broken, truncated, or badly pasted | Republish the exact value your provider gives you |
| Record found and valid | Receivers can fetch and use your public key | Check SPF and DMARC next, then monitor deliverability |
If your order confirmations, invoices, or quotes are landing in spam, a broken DKIM record may be the reason. CodexFuse manages business email, DNS, and authentication for you on credits — so the record is set up, checked, and kept working without you babysitting DNS.
Get Started with CodexFuseHow to use the CodexFuse DKIM record checker
The DKIM record checker on CodexFuse keeps the process deliberately short. The tool page itself describes three steps, and they are worth following in order rather than skipping ahead to the result.
- Enter your domain: type the domain exactly as it appears in your sending addresses, without www or an email address attached.
- Check: run the lookup so the tool queries DNS for the DKIM record by selector and analyses what it finds.
- View the record: read the returned record and its analysis instead of stopping at a pass or fail label — the detail is where selector and formatting errors show up.
One practical note: you may be asked to sign in to use the free tool, so have your CodexFuse account ready. When checking several domains, test one selector at a time — mixing selectors is the most common source of confusion.
Always get the selector from your mail provider's own setup page, not from an old blog post or a remembered value. Selectors are arbitrary labels chosen by the sender, so guessing one is no better than checking the wrong domain entirely.
What a DKIM record checker cannot tell you
Honest limits matter here, because a clean result can create false confidence if you over-read it.
- It cannot see your private key: the checker only reads the public record in DNS. A private-key problem on your sending server will not show up in this check.
- It cannot confirm your mail is actually signed: a valid published record plus an unsigned message still fails verification. Signing must be switched on at the sender.
- It cannot fix alignment: if the signing domain differs from the From domain your customers see, DMARC alignment can still fail despite a valid DKIM record.
- It cannot beat DNS caching: a record you fixed five minutes ago may still look broken until cached copies expire across the internet.
Use the checker as a public-record audit, not a complete health certificate. Pair it with a SPF record check and a blacklist check before declaring the problem solved.
DKIM, SPF and DMARC: how do they fit together?
DKIM, SPF, and DMARC are three separate checks that work best together: SPF authorises which servers may send for your domain, DKIM cryptographically signs messages so receivers can verify they were not altered, and DMARC ties both to the domain your customers see and tells receivers what to do when checks fail.
SPF asks whether a server may send for your domain, DKIM asks whether a message was signed and unchanged, and DMARC asks whether the authenticated domain matches what the reader sees. A domain with only one of the three is only partly protected.
Fixing DKIM alone sometimes disappoints: without SPF, forwarding can still break authentication, and without DMARC, receivers have no instruction for handling failures. Verify each record, fix the broken one, then recheck the set.
For the wider email setup around authentication, see how to create business email in 2026 and the small-business cybersecurity survival guide.
If the check fails, what should you fix first?
If the check fails, fix the selector first, then the record value, then the sending setup — in that order — because a wrong selector makes every other diagnosis unreliable, and a broken value cannot be rescued by changing settings at the sender.
Confirm the selector, then compare the DNS TXT value character by character with your provider's issued value, watching for line breaks and missing characters. Only then check whether signing is enabled at the sender, and remove stale records from old providers.
After any DNS change, wait for propagation before rechecking — a correct fix can briefly look like a failure. If it still fails, run a phishing and typosquatting check on lookalike domains too.
Frequently Asked Questions
What is a DKIM record?
A DKIM record is the public key your domain publishes in DNS so receivers can verify signatures on your outgoing messages and confirm they were not altered in transit.
Do I need a DKIM record for a small business domain?
Yes. Receivers increasingly treat unauthenticated mail with suspicion, so even a small domain sending invoices benefits — while routine spam-folder delivery costs lost orders and support queries.
Why does the checker find no record when my provider says DKIM is on?
Usually the selector does not match, the record sits under a different domain, or DNS has not propagated yet. Confirm the exact selector, wait, and recheck.
How often should I check my DKIM record?
Check whenever you change providers, rotate keys, move DNS, or notice deliverability problems — and a few times a year as routine maintenance, since setups drift even when records do not.
Does a valid DKIM record stop all email spoofing?
No. DKIM makes genuine mail verifiable, but it does not block lookalike domains or enforce failure handling. Pair it with SPF and a DMARC policy.
Can CodexFuse manage DKIM for me?
Yes. On CodexFuse, business email runs on the managed platform on credits, so DNS and authentication setup is handled for you instead of left as a manual DNS chore.
Move email authentication off your to-do list
A DKIM record checker answers one question well: can the outside world verify your mail? Run the check, fix the selector or the record value if it fails, then verify SPF and DMARC alongside it. Do not leave authentication as a task you will revisit after the next deliverability complaint.
If you would rather not manage DNS records, selectors, and key rotation yourself, move your business email to CodexFuse now and let the team handle authentication on credits.