deliverlensWhat this check does
Enter the signing domain and selector shown in your email platform or in the message’s DKIM-Signature header. Deliverlens queries the matching DNS name and follows a short CNAME chain when necessary.
How to read your result
The report shows whether the key was found, whether it is revoked, and whether supported RSA or Ed25519 key material can be parsed. Finding a valid public key does not verify the signature of a particular email.
What to do next
If the record is missing or malformed, compare the domain and selector with your sender’s setup instructions. After changing DNS or rotating a key, send a fresh test message and check the active selector again.
Common questions
Does a valid DKIM record mean every message passes DKIM?
No. The message must also be signed correctly, and its signed content must remain intact.
Where can I find the selector?
Look for the s= value in the DKIM-Signature header or in your email provider’s DKIM setup screen.