Free tool
DKIM Record Checker
Find a domain's DKIM public key by selector, or let us try the selectors common platforms use. See key type, key length and anything that breaks signing.
What the dkim checker does
A DKIM checker fetches the public key a domain publishes at selector._domainkey.domain and checks that receivers can use it to verify signatures. This one tries the selectors Google Workspace, Microsoft 365 and the major sending platforms use when you do not know yours, reads the RSA key length straight from the key, and flags revoked keys, testing mode and weak 1024-bit keys.
How it works
How the DKIM Checker works
-
Domain and selector
Enter the signing domain and the s= selector from a DKIM-Signature header, or leave the selector empty.
-
Key lookup
We query the selector over DNS-over-HTTPS, or try dozens of common selectors in parallel.
-
Key analysis
We decode the public key to read its type and length and check every tag in the record.
Reading your result
What the result means
-
2048-bit RSA or Ed25519 key
A strong, active key. Signatures with this selector verify.
-
1024-bit key or testing mode
Signing works, but rotate to a 2048-bit key and remove t=y.
-
No key or revoked key
Signatures using this selector fail. Publish the key your sending platform gives you.
FAQ
DKIM checker FAQ
Where do I find my DKIM selector?
Open a message sent from the domain, view the original source and find the DKIM-Signature header. The s= tag is the selector and d= is the signing domain. Google Workspace uses google by default and Microsoft 365 uses selector1 and selector2.
What DKIM key length should I use?
Use 2048-bit RSA keys. RFC 8301 requires at least 1024 bits, and 1024-bit keys are now considered weak. Some DNS hosts need a 2048-bit key split into several quoted strings in one TXT record, which is normal.
What does an empty p= tag mean?
An empty p= tag revokes the key. Any signature that uses that selector fails verification. Providers publish an empty key when they rotate to a new selector.
Why does the checker not find my key without a selector?
DNS cannot list every selector a domain has, so we try the ones common sending platforms use. Custom selectors need to be entered by hand. Read s= from a real message to be sure.
Does DKIM need to align with my From domain?
For DMARC, yes. The d= domain in the signature must match the From domain, exactly with strict alignment or at the organisational level with relaxed alignment. A platform signing with its own domain passes DKIM but does not help DMARC.
Keep going
More free email tools
-
Free Email Verifier
Check syntax, domain, MX records and disposable status for any address.
Open tool -
Email Syntax Checker
Validate an address against the RFC 5321 rules our engine uses and catch typos.
Open tool -
Catch-All Checker
See whether a domain accepts mail for every address, and what that means for your list.
Open tool -
Role Email Checker
Flag info@, sales@, support@ and 250+ other shared inbox patterns in bulk.
Open tool -
Disposable Email Checker
See whether an email or domain belongs to a temporary inbox provider.
Open tool -
SPF Checker
Look up and validate an SPF record, count DNS lookups and expand every include.
Open tool -
DMARC Checker
Read and grade a domain's DMARC policy, reporting and alignment settings.
Open tool -
Bulk email verification
Verify every mailbox on a list of up to 100,000 addresses in one job.
Clean a list
Signed, sealed and delivered
DKIM proves your mail is genuine. Verifying your list proves every recipient is real.
100 free credits · No card required · Credits never expire