Free DKIM record checker
Scan a domain for DKIM keys at common selectors, or enter the selector from an email header to check one key. See key type, length and flags in plain language.
- Free, no sign-up
- Runs in your browser
- Reads real key length
Lookups run in your browser against public DNS. We do not see or keep the domain you enter.
What is DKIM?
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message a service sends for you. The matching public key sits in DNS at selector._domainkey.yourdomain, and receivers use it to confirm the message came from an authorised service and was not changed on the way.
Each sending service gets its own selector and key, so you can add, rotate or retire one without touching the others.
About this tool
- Without a selector, we query 30 selectors used by Microsoft 365, Google Workspace, Zoho, Proton, Fastmail, Mailchimp, Resend and others.
- Key length is read from the public key itself, not estimated from its size.
- A key found here proves it is published. Whether your mail is actually signed with it shows only in message headers.
What the checker tests
p=Key published
Whether a key exists at the selector, or has been revoked with an empty value.
2048Key strength
RSA keys under 1024 bits are ignored by receivers. 2048 is the recommended minimum.
t=yTesting flag
A key left in testing mode after go-live can be treated leniently by receivers.
CNAMEWho manages it
Whether the key is delegated to the sending service so that it can rotate it.
DKIM questions
Short answers to what people ask most about DKIM keys and selectors.
What is a DKIM selector?
A selector is the name that tells receivers where to find a public key, so one domain can hold a separate key for each sending service. It appears as s= in the DKIM-Signature header. Microsoft 365 uses selector1 and selector2, Google Workspace uses google by default, and Mailchimp uses k2 and k3.
How do I find my DKIM selector?
Open an email the service sent, view the full header, and find the DKIM-Signature line. The s= value is the selector and d= is the signing domain. Paste the header into our email header analyser to pull both out automatically.
Is a 1024-bit DKIM key still safe?
Major mailbox providers still accept 1024-bit RSA keys, but 2048-bit is the recommended minimum today. If your provider supports 2048-bit keys, rotate to one. Replace keys shorter than 1024 bits immediately, because receivers may ignore them.
Why does the checker find no DKIM keys?
A selector can be any name, so a scan of common names can miss yours. Services such as Amazon SES, HubSpot and Mimecast create unique selectors for each customer. Find the s= value in a message header, then enter it as the selector.
Does DKIM on its own stop spoofing?
No. DKIM proves which domain signed a message, but that domain does not have to match the From address. DMARC links the two: it passes only when the DKIM signing domain aligns with the visible From domain.
Does every service that sends as my domain need DKIM?
Ideally, yes. Microsoft 365, your accounting system, your newsletter tool and your CRM should each sign with your domain using their own selector. DKIM survives forwarding, so it is what carries DMARC when SPF breaks.
More free tools
Want SPF, DKIM and DMARC handled for you?
MailMarq finds every service sending as your domain, fixes SPF and DKIM for each one, and takes you to p=reject in stages you approve. Fully managed from R3,290 a year.