DKIM Checker

Check a DKIM key

Look up the DKIM public key for a domain and selector, or try the selectors that Google, Microsoft and the main mail services use, and check the key is strong enough to be trusted.

Guide

What the DKIM checker tests

DKIM keys are published at <selector>._domainkey.your domain. DNS cannot list selectors, so you either give one — it is the s= value in the DKIM-Signature header of a message the domain sent — or the checker tries the ones common services use.

  • The record. Parses, has a p= key, and v=DKIM1 first if present. Two key records at one name make verification fail at random.
  • Key strength. RFC 8301 requires receivers to reject RSA keys under 1024 bits and asks signers for 2048. The checker reads the key length from the key itself. Ed25519 keys (RFC 8463) are recognised.
  • Revoked keys. An empty p= revokes the key; correct for a retired selector, a problem if anything still signs with it.
  • Testing and hashes. t=y asks receivers to ignore signatures, and a key limited to h=sha1 cannot produce a signature receivers accept.

A published key shows a domain can sign, not that it does; the report says so. Not finding a key at the common selectors proves nothing either.

FAQ

DKIM: common questions

How do I find my DKIM selector?

Open a message the domain sent and view its original headers. The DKIM-Signature header contains s=, the selector, and d=, the signing domain. The key is published at <selector>._domainkey.<domain>. Google Workspace uses google by default and Microsoft 365 uses selector1 and selector2.

What DKIM key length should I use?

2048-bit RSA. RFC 8301 says receivers must not accept keys under 1024 bits, and 1024-bit keys are considered weak. Most providers now generate 2048-bit keys by default; older setups may need rotating.

Why does the checker not find my DKIM key?

Selectors cannot be listed from DNS, so without one the checker can only try common names. Enter the selector from the s= value of a DKIM-Signature header and it will check that key directly.

Guides

Learn more

  • What DKIM is and how to set it up How DKIM signatures work, where the public key lives in DNS, what a selector is, and how to turn DKIM on for the services that send your mail.
  • DKIM2: the next version of DKIM, explained DKIM2 is an IETF draft that chains signatures across every hop, records how intermediaries change a message, and stops DKIM replay. What it does and where it stands.
  • SPF, DKIM and DMARC explained How the three email authentication standards fit together, what each one proves, and which you need to stop people sending email as your domain.