DKIM Checker

Find a domain's DKIM key by selector and check its syntax and key length.

DKIM record lookup and key check

DKIM signs every message with a domain key, and the receiver verifies the signature against the public key in DNS at selector._domainkey.domain. This tool finds that record for your selector or tries 30 common ones (Google Workspace, Microsoft 365, Mailchimp, SendGrid, Zoho, Fastmail, Proton, HubSpot and more), follows CNAMEs, parses the tags and measures the RSA key length. Selectors cannot be listed via DNS, so "not found" only means "not among the selectors checked".

Check one selector or try 30 common ones

RSA and Ed25519 key length: weak, 1024, 2048+

CNAME delegation and dangling CNAMEs

Revoked keys (empty p=), t=y, h=sha1, broken base64

How to Use

Enter the domain; take the selector from the DKIM-Signature header (s=) if you have it
Without one we try 30 common selectors — it takes a few seconds
Check the key status and replace keys shorter than 2048 bits

FAQ

The selector is the key's name: the record lives at selector._domainkey.domain, and a domain can have several keys for different services. The exact selector is in the DKIM-Signature header of any sent message — the s= value, while d= is the signing domain. In Gmail use "Show original".

Most likely your service uses a non-standard selector: DNS does not allow listing names, so without a selector we can only try 30 common ones. Amazon SES, for example, creates three random selectors per domain. Enter the selector from a message header.

2048 bits. 1024-bit keys are still accepted but considered the minimum, and per RFC 8301 receivers must not accept keys shorter than 1024. A 2048-bit key is longer than 255 characters and is stored as several strings in one TXT record — modern DNS dashboards handle that automatically.

The key has been revoked: mail signed with this selector fails DKIM. This is how old keys are retired after rotation. If you still sign with this selector, publish the key again or switch signing to the current selector.

Microsoft 365, SendGrid, Mailchimp and others work this way: you publish a CNAME to their zone, and they store and rotate the key. That is normal. It is only a problem when the CNAME target has no record — then signatures fail; in Microsoft 365 it means DKIM is not enabled in the admin center.

How DKIM works and what this checker tests

DKIM (DomainKeys Identified Mail) adds a digital signature to every message. The sending server signs the headers and body with a private key; the receiver fetches the public key from DNS and confirms the message was not altered in transit and really comes from the domain owner. The public key lives in a TXT record at selector._domainkey.domain.

The DKIM checker finds that record, follows a CNAME if there is one, parses the tags and rates the key:

Status	Meaning
key OK	RSA 2048 bits or more, or Ed25519, with no record errors
1024-bit — upgrade	Still accepted, but it is the minimum; move to 2048
weak key	Under 1024 bits — per RFC 8301 receivers must not accept these signatures
key revoked	Empty `p=`: signatures with this selector fail
invalid record	Unreadable key, wrong version or unknown key type

How to find your DKIM selector

The selector is the key's name. The sender picks it, and a domain can have any number of selectors for different services. DNS offers no way to list them, so without a selector the tool tries the 30 most common ones. If nothing turns up, that only means "not among the selectors checked", not "no DKIM".

The exact selector is in every message sent from the domain. In Gmail, open a message → "Show original" and find the header:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=google;
        h=from:to:subject:date:message-id; bh=...; b=...

s=google is the selector and d=example.com the signing domain. The receiver's verdict appears in Authentication-Results: dkim=pass [email protected] header.s=google. For DMARC, the d= domain must match the From domain — the DMARC checker covers that side.

Selectors used by popular services

Service	Selector and record type
Google Workspace	`google` by default (customisable), TXT with the key
Microsoft 365	`selector1` and `selector2`, CNAMEs into Microsoft's zone
Mailchimp / Mandrill	`k1` (also `k2`, `k3`), CNAME
SendGrid	`s1` and `s2`, CNAMEs to sendgrid.net
Amazon SES	three random selectors per domain, CNAMEs to dkim.amazonses.com — impossible to guess; take them from the SES console or a message header
cPanel/Plesk hosting	often `default` or `mail`

Providers change names and schemes, so check their documentation. A CNAME means the provider stores and rotates the key for you, which is fine. It is a problem only when the CNAME exists but its target has no record: signatures fail. In Microsoft 365 that usually means DKIM is not enabled for the domain in the admin center.

DKIM record syntax

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...

v=DKIM1 — version; optional, but if present it must come first.
k — key type: rsa (default) or ed25519.
p — the base64 public key. An empty value means the key is revoked.
t=y — testing mode: receivers should treat signed mail as unsigned. Remove it after rollout. t=s is strict mode for subdomains.
h — allowed hash algorithms. If it lists only sha1, signatures fail: per RFC 8301 sha1 is no longer accepted.
s — service type; * or email for mail.

A 2048-bit key is longer than 255 characters, so DNS stores it as several strings inside one TXT record. Most DNS dashboards split it automatically; if yours wants manual input, break the value into quoted chunks with no spaces inside the key.

Key length and rotation

Use 2048-bit RSA. To replace a key without downtime:

Create a new key under a new selector (for example s2026) and publish it in DNS.
Check it here with that selector.
Switch signing to the new selector in your mail server or service.
After a few days, once mail signed with the old key has been delivered, publish the old selector with an empty p=, and later delete it.

For a self-hosted server you can generate a key with OpenDKIM or plain OpenSSL:

opendkim-genkey -b 2048 -s s2026 -d example.com
# or
openssl genrsa -out dkim.key 2048
openssl rsa -in dkim.key -pubout -outform der | base64

DKIM, SPF and DMARC together

DKIM survives forwarding while SPF usually breaks, so a DKIM signature with your own domain is the most reliable way to pass DMARC. Since February 2024 Google and Yahoo require bulk senders to use both SPF and DKIM plus a DMARC record; the details change, so check their current sender guidelines. Check the full set: SPF, DMARC and MX records.