Check 9 of 54 · Email authentication
Whether your signing keys are long enough that nobody can forge them.
Engine 1.57.0, read 25 October 2026
Can someone send email as you?
The keys found on the common selectors. RSA under 1,024 bits fails, under 2,048 warns, 2,048 or Ed25519 passes, and an RSA key that cannot be read fails. A key of any other type cannot be sized, so the check is not graded rather than passed.
A short key can be cracked, and a cracked key signs fakes that pass every check.
A failure is a finding in your result. The check is scored, so it can lower your score, and the Full Report gives every finding its severity and a fix. If the check cannot finish, it is recorded as unknown: it carries no penalty, and it is never a pass.
Only sizes the keys it can see, so a custom selector may not be graded.
Check 9 is one of 16 in Email authentication. See it in its row on the scanner page, beside the rest of Email authentication.
The DKIM checker runs it on its own. It reads the public keys that prove your email was signed by you, on the common selectors or your own.
The free check includes this one and takes about 30 seconds. No account. Nothing to install.