A key that is published
A DKIM key lives at a selector under _domainkey. We look on the selectors most mail services use, and on yours if you name it.
DKIM checker
Check your DKIM record. Free, with no account.
Type in a domain. We look for its DKIM keys on the common selectors, and on yours if you type it in, and grade them as the Full Report does: whether a key is published and whether it is long enough that nobody can forge it.
Source: RFC Editor, RFC 6376.
- Reads only public DNS
- No account, nothing to install
- Your own selector too
What the DKIM checker looks at
Long enough not to forge
A key under 1024 bits can be broken, so it fails. 2048 bits is the modern minimum, so a 1024-bit key gets a warning.
Keys that were withdrawn
A selector that publishes an empty key has been revoked. We show it, so an old selector left in DNS is easy to spot.
Not found is not missing
Selectors cannot be listed from DNS, so we say we could not confirm DKIM. Where your mail runs through Microsoft 365, we know where its keys belong.
These are checks 3 and 9 on the scanner page, graded by the same rules as the free check and the Full Report.
Finding your selector
Header · DKIM-Signature · an email you sentExample
v=1; a=rsa-sha256; d=yourcompany.co.uk; s=selector1; h=from:to:subject:date; b=Kx9…
Open an email you sent and view its headers: Show original in Gmail, View message details in Outlook.
Find the DKIM-Signature line. The value after s= is the selector, and d= is the domain it signs for.
Microsoft 365 signs with selector1 and selector2, and Google Workspace with google. The checker looks on both without being told.
How DKIM works, and why it matters more once a domain reaches reject: DKIM explained.
Questions
What is a DKIM record?
A public key published in DNS at a selector under _domainkey on your domain. Your mail service signs each message with the matching private key, and receivers use the record to check the signature.
How do I check my DKIM record?
Type your domain into the checker at the top of this page. We look on the selectors most mail services use. If you sign with another, type it in as well. You need no account.
What is a DKIM selector?
The name a key is published under, so one domain can hold several keys. It is the s= value in the DKIM-Signature header of an email you sent.
Why does the checker say it could not confirm DKIM?
Selectors cannot be listed from DNS, so a key on a selector we did not try is invisible to us. Type your selector in and check again.
Should my DKIM key be 1024 or 2048 bits?
2048. A 1024-bit key still verifies, but it is no longer strong enough. If the key belongs to a service you send through, the change is made in that service, not in your DNS.
Does DKIM on its own stop someone sending email as me?
No. DKIM proves a message was signed by a domain, not that the domain was the one in the From line. DMARC ties the two together.
More free checkers
TXT · your domain
SPF checker
Reads the record that lists the servers allowed to send email as you, and counts the DNS lookups it costs.
Check SPFTXT · _dmarc
DMARC checker
Reads your instruction to inboxes about mail that fails, and whether its reports reach anyone.
Check DMARCTXT · _mta-sts · policy file
MTA-STS checker
Reads the policy that asks senders to deliver mail to you only over an encrypted connection, and your TLS reporting.
Check MTA-STS
Start with the free check.
It reads your SPF, DKIM and DMARC records in about 30 seconds, and tells you where you stand today.