DKIM record checker

What it checks

• Whether a DKIM key is published at each selector tested.
• Common provider selectors when you don't know yours, such as google, selector1 and selector2, k2 and s1.
• Revoked keys: a record with an empty p= value.
• Approximate RSA key size, with a warning for 1024-bit keys.
• Email services that should be signing but have no key found, such as Microsoft 365 or Google Workspace.

How DKIM keys are published

Each DKIM key is a TXT record at selector._domainkey.yourdomain. The selector is part of the signature in every message, in the s= value of the DKIM-Signature header, so receivers know where to look. Providers such as Microsoft 365 publish keys through CNAME records pointing to their own systems; the checker follows those automatically.

Finding your selector

If no key is found, the domain may simply use a selector the checker didn't try. Open a message you sent, view its full headers, and find s= in the DKIM-Signature header. Or paste the headers into the email header analyzer, which reads the selector for you and runs the DKIM check with it.

Frequently asked questions

What is a DKIM selector?

A name that tells receivers where to find the public key for a signature, such as selector1 or google. A domain can have several, one per sending service.

Is a 1024-bit DKIM key still OK?

It still works, but 2048-bit keys are recommended. Most providers let you rotate to a longer key in their admin console.

Why does the checker find no DKIM key?

The domain may use a selector that wasn't tested, or DKIM isn't set up. Check the s= value in a sent message's headers.

Does DKIM alone make DMARC pass?

Yes, if the signing domain aligns with the From domain and the signature is valid. Aligned DKIM is the most reliable way to pass DMARC.