Example : 

How to set up an email or change my account settings.

How to Confirm Your DNS/DKIM Records Are Set Up Correctly

After adding a DKIM TXT record to your DNS, it’s important to confirm it was published correctly before you rely on it for email authentication. A misconfigured or missing DKIM record may not show immediate errors, but it will cause DKIM signature checks to fail, which can negatively impact outgoing mail deliverability and cause DMARC alignment to fail.
 

 

Table of contents

  1. What you need before checking
  2. Check the record using dig or nslookup
  3. Use an online DKIM checker
  4. Send a test email to confirm signing works
  5. Common mistakes to check for
  6. FAQ

What you need before checking

To look up a DKIM record, you need two pieces of information:

1. Your DKIM selector — a short string set by email provider (e.g., default, google, or selector1). You’ll find this in your email service’s admin panel, or in the s= value of a DKIM-Signature header in a sent email.

2. Your sending domain — the domain the DKIM record was published under.

• Note: The DKIM record always lives at default._domainkey.yourdomain.com, not at the root domain. Looking up the wrong hostname is the most common reason a lookup comes back empty.

 

Check the record using dig or nslookup

1. Open a terminal (macOS/Linux) or command prompt (Windows).

2. Run one of the following, replacing default and yourdomain.com with your actual values:

  1. dig TXT default._domainkey.yourdomain.com
  2. nslookup -q=txt default._domainkey.yourdomain.com

3. Look for a TXT record in the response that starts with v=DKIM1.

  1. A correctly published record looks like this:
    v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
  2. If you’re using a 2048-bit key, the p= value is long enough that it’s normal to see it split into two quoted strings in the DNS response, like ‘v=DKIM1; k=rsa; p=MIIBIj’ ‘AQEFAAOC’. This is expected — the two strings are concatenated automatically when the record is parsed, and it should still be entered as one record, not two separate TXT records.

• Note: If the lookup returns nothing, the record may not have propagated yet, the selector or hostname may be wrong, or the record may not have been published at all. DNS changes can take anywhere from a few minutes up to 24–48 hours to propagate fully.

 

Use an online DKIM checker

If you’d rather not use the command line, several free online tools will look up and validate a DKIM record for you, just enter the domain and selector. These tools typically confirm whether the record is syntactically valid and flag common problems automatically, which is useful if you’re not sure what to look for in the raw DNS output.

 

Send a test email to confirm signing works

A published DNS record only tells you the key exists, it doesn’t confirm your mail server is actually signing messages with it. To check:

  1. 1. Send a test email from your domain to an account you control (Gmail works well for this).
  2. 2. Open the received message and view its original source (in Gmail: the three-dot menu > Show original).
  3. 3. Look for a DKIM-Signature header and check that Gmail reports DKIM: PASS next to the SPF and DMARC results.

 

Common mistakes to check for

• Publishing the key as two separate TXT records instead of one record with two quoted strings.
• Looking up the root domain instead of default._domainkey.yourdomain.com.
• Using the wrong or outdated selector after rotating keys.
• Extra line breaks, quotes, or whitespace introduced when copy-pasting the key into the DNS host’s record editor.
• Checking before DNS propagation has finished and assuming the record failed.

 

FAQ

How long does it take for a new DKIM record to become active?
Usually within minutes, but DNS update can take up to 24–48 hours to propagate online.

Can I have more than one DKIM record?
Yes, as long as each one uses a different selector. This is common when rotating keys or using multiple email services.

What does it mean if p= is empty?
An empty p= value means the key has been intentionally revoked. Any mail signed with that selector will fail DKIM verification.

Related Articles