What this DKIM checker does
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email. Receivers check it with a public key published in your DNS. This DKIM checker finds that key and verifies it is usable:
- Finds the record at
selector._domainkey.yourdomain.com, including keys your email provider hosts behind a CNAME. - Reads the public key and reports its type (RSA or Ed25519) and its real size in bits, decoded from the key itself rather than guessed from its length.
- Checks the tags: version, key type, hash algorithms, and the testing flag
t=y, which tells receivers to treat failures leniently. - Spots problems: revoked keys (empty
p=), malformed keys, weak keys under 1024 bits, and duplicate records.
If you don't know your selector, leave the field empty. The checker tries around 40 selectors used by common providers (Google Workspace, Microsoft 365, Zoho, Fastmail, Mailchimp, SendGrid, HubSpot, Proton and others) all at once.
What is a DKIM selector?
A domain can have many DKIM keys, one for each service that sends its mail, or old and new keys during a rotation. The selector is the name that tells receivers which key to use. It appears in every signed message, in the DKIM-Signature header as s=:
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=google; ...Here the key is at google._domainkey.example.com. Open any email you sent, view the original message or headers, and look for s=.
Recommended key settings
| Setting | Recommendation |
|---|---|
| Key type and size | RSA 2048-bit (widely supported). Ed25519 is modern and compact, but publish an RSA key alongside it. |
| 1024-bit RSA | Still accepted, but upgrade when your provider allows it. |
| Under 1024 bits | Rejected by major providers. Replace immediately. |
Testing flag t=y | Remove it once DKIM is working. |
| Rotation | Change keys periodically (for example yearly) using a new selector, then revoke the old one. |
Why DKIM matters
Unlike SPF, DKIM survives email forwarding, because the signature travels with the message. It's also the authentication method most likely to align with your From address when you use third-party senders, which is what DMARC needs to pass. Set up DKIM for every service that sends as your domain, then confirm your SPF record too.
Related tools and guides
Frequently asked questions
The checker found no common selector. Is DKIM missing?
Not necessarily. Many providers, such as Amazon SES and some marketing platforms, use unique, random-looking selectors that can't be guessed. Find yours in a sent message's s= tag and enter it above.
Why is my DKIM record a CNAME?
Many providers ask you to add a CNAME that points to a key they host. That lets them rotate the key without you editing DNS. The checker follows the CNAME and shows the final key.
What does an empty p= mean?
An empty public key means the key has been revoked. Messages signed with that selector will fail DKIM.
How long can a DKIM record be?
A 2048-bit key is longer than the 255-character limit of a single TXT string, so it is split into several strings in one record. DNS joins them back together, and the checker does the same.