The DKIM Lookup tool finds and checks the DKIM public key of a domain. Enter a domain and, if you know it, the selector: without one, the tool tries the selectors of the most common mail services (Google Workspace, Microsoft 365, Mailchimp, SendGrid, Zoho, Proton, Fastmail…). For each record found, it shows the key type and size, and flags what makes receivers ignore the signatures: a revoked key, a key shorter than 1,024 bits, SHA-1 only, or the test mode.

DKIM (DomainKeys Identified Mail, RFC 6376) lets a domain sign the emails it sends. The sending server adds a DKIM-Signature header, and the receiving server checks it with the public key published in the DNS at <selector>._domainkey.<domain>. A valid signature proves that the email comes from the domain and was not altered on the way. Together with SPF, it is what DMARC relies on to decide whether to deliver, quarantine or reject an email.