DKIM checker
Check the DKIM key a domain publishes for signing its email: whether it is there, its type and size, and common mistakes.
Choosing a check opens its page. With the keyboard, use the arrow keys, then press Enter.
What we check
DKIM (RFC 6376) lets a mail server sign each message it sends. Receivers check the signature with a public key the domain publishes in DNS at <selector>._domainkey.<domain>. We look up that key and check:
- that there is exactly one key record, and that it is written correctly;
- the key type (RSA or Ed25519) and, for RSA, its size: under 1024 bits fails, 1024 bits works but 2048 bits is recommended (RFC 8301);
- testing mode (
t=y), sha1-only keys, revoked keys (an emptyp=) and keys not meant for email; - CNAME records that point to a provider, as Microsoft 365, SendGrid and Mailchimp use, and whether the provider has a key there.
Finding your selector
Open a message the domain has sent and view its original or full headers. In the DKIM-Signature header, s= is the selector and d= is the signing domain. Common selectors are google for Google Workspace and selector1 or selector2 for Microsoft 365. If you leave the selector blank, we try 8 common names, but selectors can be anything, so not finding one doesn't mean there is no DKIM.
What this can't tell you
We only read DNS. We don't send or receive mail, so we can't tell whether a message's signature passes, or whether its signing domain lines up with the From address for DMARC. A received message's Authentication-Results header shows that.
Frequently asked questions
What is DKIM?
DomainKeys Identified Mail (RFC 6376). The sending mail server adds a digital signature to each message, and receivers check it with a public key the domain publishes in DNS. A valid signature shows the message wasn't changed on the way and was sent with the domain's permission.
How do I find my DKIM selector?
Open a message the domain has sent, view the original or full headers and find the DKIM-Signature header. The selector is the s= value and the domain is the d= value. Your mail provider's DKIM settings page shows it too.
What if I leave the selector blank?
We try 8 common selectors: google, selector1, selector2, k1, s1, s2, default and dkim. Selectors can be any name, so "none found" doesn't mean the domain has no DKIM. Enter the selector from a sent message to be sure.
Is a 1024-bit key still OK?
It still works, but RFC 8301 recommends at least 2048 bits, and keys under 1024 bits must be rejected. Most providers let you rotate to a 2048-bit key from their DKIM settings.
Does a valid key mean my mail passes DKIM?
Not on its own. This checks the published key only. Whether a message passes depends on its signature, and for DMARC the signing domain (d=) must match the From domain. Check a received message's Authentication-Results header to be sure.
Guides about this tool
-
Email
Moving DMARC from p=none to reject, safely
How to read DMARC reports, fix every real sender and move from monitoring to quarantine and reject in stages, without blocking your own email.
-
Email
Email health checklist: what to check before you send
The DNS records and other checks that decide whether your email is trusted, from MX, SPF, DKIM and DMARC to reverse DNS, BIMI, MTA-STS and DNSSEC.
-
Email
DKIM explained: selectors, keys and why signatures fail
What DKIM signs, how to find your selector, how Google Workspace and Microsoft 365 set it up, 1024 versus 2048-bit keys, safe key rotation and the usual reasons signatures fail.
Related tools
-
DMARC Checker
Find the DMARC policy that applies to a domain, see what each setting means, and spot mistakes that make receivers ignore it.
-
SPF Checker
Check that a domain's SPF record is valid, stays within the 10-lookup limit, and says what you expect about servers that may send its mail.
-
MX Lookup
See which mail servers receive email for a domain, in priority order, with each server's addresses.
-
BIMI Checker
Check whether a domain is set up to show its logo next to its emails: the BIMI record, DMARC, the logo file and the mark certificate.
-
DNS Lookup
Look up the DNS records published for a domain, one type or all common types at once, or the reverse DNS name of an IP address.
-
Website Health Check
Run the main website, DNS and email checks on one site at once and get a short report, area by area, with links to the full results.