How to Use the DKIM Checker
Enter the domain and, if you know it, the selector from a message header, then read the key details for each selector found.
- Enter the domain that signs your mail, such as example.com.
- Enter the selector from the s= tag of a DKIM-Signature header, or leave the field empty to try common selectors.
- Select Check DKIM to look up the TXT record at selector._domainkey and the domain.
- Read the key type and bit size, then fix any key errors in your DNS or with your email provider.
DKIM Record Check
A DKIM record check confirms that the public key at a selector is published, readable and long enough for receivers to verify signatures.
DKIM Selector Lookup
DKIM keys are published at a name made of the selector, _domainkey and the domain, such as google._domainkey.example.com. With a selector, the checker queries exactly that name. Find the selector in the s= tag of the DKIM-Signature header of a message you sent.
DKIM Checker Without Selector
With an empty selector field, the checker tries 21 common names, including selectors used by Google, Microsoft 365, Cloudflare, iCloud, Fastmail, Proton Mail and Mailgun. Selectors are not listed anywhere in DNS, so no result only means that none of these names is in use. Use the selector from a real message for a precise answer.
Check DKIM Bit Size
RSA keys are decoded with the browser’s Web Crypto API to read their modulus length. Keys shorter than 1024 bits are reported as errors, and keys below 2048 bits come with a recommendation to upgrade. Ed25519 keys must be exactly 256 bits.
No DKIM Record Found
No key at the tested selectors means that the selector is different or that the domain does not sign with DKIM. An empty p= tag means the key has been revoked on purpose. Invalid base64, a missing p= tag and an unsupported algorithm are each reported as key errors.
DKIM 1024 vs 2048-Bit Keys
A 2048-bit RSA key is the current recommendation, because 1024-bit keys are considered too weak for long-term use.
| Key | Strength | Notes |
|---|---|---|
| 1024-bit RSA | Minimum accepted length | Still verified by receivers, but replace it when you can |
| 2048-bit RSA | Recommended for RSA | Fits in a TXT record split into several strings |
| Ed25519 (256-bit) | Strong with a short key | Not verified by every receiver, so publish it next to an RSA key |
Frequently Asked Questions
What Is a DKIM Selector?
A selector is the name that tells receivers which DKIM key to fetch, because one domain can publish several. It appears in the s= tag of the DKIM-Signature header and is chosen by your email provider.
How Do You Check DKIM Is Working?
Send a message to an outside mailbox and open its headers. A dkim=pass result in the Authentication-Results header confirms the signature, while this checker confirms that the public key in DNS is valid.
How Often Should DKIM Keys Be Rotated?
Industry guidance from M3AAWG suggests rotating DKIM keys at least every six months. Publish the new key under a new selector, switch signing to it, then revoke the old key once mail in transit has been delivered.
Can a DKIM Record Be a CNAME?
Yes. Many providers ask you to publish a CNAME at the selector name that points to a key they manage. The DNS lookup follows the CNAME, so the checker shows the key at its target.
Related Email Tools
Continue with the guide How to Read Email Headers. Trace delivery and interpret authentication.