Check whether a DKIM public key is published for a selector and domain. If you do not know the selector, ScoutLab can try a small set of common selector names.
DKIM signs email with a private key and publishes the corresponding public key in DNS below selector._domainkey.domain. The selector tells receivers which public key to retrieve for a particular signature.
There is no universal directory of DKIM selectors. Providers choose their own names and may rotate them, so guessing common selectors is only a convenience. The most reliable source is the s= selector in a real DKIM-Signature header or your email provider's DNS setup instructions.
Finding a public key confirms that the DNS record exists; it does not prove that a particular message has a valid DKIM signature.
This utility checks one email-authentication signal. ThreatScout's free website security scan also reviews HTTPS, security headers, DNS and the broader email-protection configuration.
Run the full free website security scanYes. It queries public DNS and does not require an account, email address or payment details.
A selector is the label used to locate a DKIM public key in DNS. It appears as the s= value in a DKIM-Signature header.
You can leave the selector blank and ScoutLab will try several common names. Because selectors are arbitrary, a no-result common scan is not proof that DKIM is absent.
No. A published public key is necessary for verification, but a specific message must also contain a valid signature that verifies against that key.
