Enter a sending domain. We look up its google._domainkey record live and check whether a Google Workspace DKIM key actually resolves there.
Loading tool…
Lower stack cost. Back in the inbox. Built to send at any scale.
We rebuild it properly: secondary domains, inboxes, SPF, DKIM and DMARC set to enforcement, warmup and safe sending limits, blacklist monitoring on top. Send-ready in about 17 days. No campaigns, no copy, no lead lists. Infrastructure only.
Almost a decade building cold outreach infrastructure, including his own sending and verification stack built from scratch. 20+ B2B clients at companies worth $10M and above, all in tier one countries.
Free · Written plan + fixed price · No sales call required
Google Workspace signs outgoing mail with DKIM only after an admin generates a key in the Google Admin console and publishes it in DNS. That key lives at one name: google._domainkey on the sending domain. This checker looks up that exact name and gives a plain verdict on whether a Google DKIM key resolves there.
DKIM is one leg of three. For a general look at any selector, use the DKIM Checker; to see SPF, DKIM and DMARC in one pass, use the Email Authentication Checker — and you can put that checker on your own site from the embed page.
If no key resolves, the usual causes are that DKIM was never turned on in the Admin console, the TXT record was published at the wrong name, or DNS has not propagated yet. If you would rather have authentication set up and verified end to end for you, see Start a build.
At google._domainkey.yourdomain as a TXT record, after you generate it in the Google Admin console.
No. The record must be published in DNS, and signing must then be started in the Admin console.
Give DNS time to propagate — often minutes, sometimes a few hours — then run this check again.
It covers what is broken, what we would build, the timeline, and one fixed price. Want it walked through instead? Book a 15 minute plan walkthrough.
Or just reply to the plan email. Either works.
