Check whether a DKIM public key is published for a selector and domain. If you do not know the selector, ScoutLab can try a small set of common selector names.
DKIM signs email with a private key and publishes the corresponding public key in DNS below selector._domainkey.domain. The selector tells receivers which public key to retrieve for a particular signature.
There is no universal directory of DKIM selectors. Providers choose their own names and may rotate them, so guessing common selectors is only a convenience. The most reliable source is the s= selector in a real DKIM-Signature header or your email provider's DNS setup instructions.
Finding a public key confirms that the DNS record exists; it does not prove that a particular message has a valid DKIM signature.
In a received message's original headers, DKIM-Signature: ... d=example.com.au; s=mail2026; ... identifies the signing domain and selector. Enter example.com.au and mail2026 to look up mail2026._domainkey.example.com.au. These are illustrative values, not a diagnostic result.
Use the d= signing domain for key lookup; it may differ from the visible From domain. Whether they align is a separate DMARC question. Multiple signatures can use different domains and selectors, so check the relevant signature rather than assuming the first one represents every sender.
If a common-selector search finds nothing, obtain the current selector from your provider or a message. A published key does not verify the signature or message body, and an empty p= key signals revocation. After checking email DNS, the free website security scan adds public HTTPS and header observations.
This utility checks one email-authentication signal. ThreatScout's free website security scan also reviews HTTPS, security headers, DNS and the broader email-protection configuration.
Run the full free website security scanYes. It queries public DNS and does not require an account, email address or payment details.
A selector is the label used to locate a DKIM public key in DNS. It appears as the s= value in a DKIM-Signature header.
You can leave the selector blank and ScoutLab will try several common names. Because selectors are arbitrary, a no-result common scan is not proof that DKIM is absent.
No. A published public key is necessary for verification, but a specific message must also contain a valid signature that verifies against that key.
