DKIM record checker

Check whether a DKIM public key is published for a domain and selector, and how strong it looks.

What is DKIM?

DomainKeys Identified Mail (DKIM) lets a sending system add a cryptographic signature to each message. The signature names a domain (d=) and a selector (s=). A receiving server fetches the public key from DNS at selector._domainkey.domain and uses it to verify that the signed parts of the message were not altered and that the signing domain authorised the signature.

Why you need a selector

One domain can publish many DKIM keys at once, one per sending service or per rotation, and DNS offers no way to list them. You must therefore know the selector. The easiest source is a message you have received from that domain: open the original headers and read the s= tag in the DKIM-Signature header. Otherwise try the common defaults. Google Workspace usually uses google, Microsoft 365 uses selector1 and selector2, and some providers use k1, s1, s2 or default. A missing result for one guess only means that selector is not published, not that the domain has no DKIM.

Reading the result

• Key type. RSA is the most common type. Ed25519 keys are shorter and also valid, though not every receiver supports them yet.
• Key length. For RSA the tool reads the modulus size from the published key, or estimates it from the encoded length when it cannot. 2048 bits is the commonly recommended size for new keys; 1024 bits is still seen but weaker. Very long keys can exceed the 255-character limit of a single DNS string, so providers split them into several quoted strings, which this tool joins back together.
• Empty p= value. This marks a revoked key. Signatures made with it fail by design.
• CNAME. Many providers ask you to point the selector at their own name so they can rotate keys for you. The tool shows the CNAME target when it sees one.
• t=y. Testing mode, which some receivers handle more leniently.

What this tool cannot show

It confirms that a key is published; it does not test whether your mail is actually signed with it. To confirm that, send a message to a mailbox you control and look for dkim=pass in the authentication results header. Even a passing signature does not guarantee inbox delivery.

Where DKIM fits

DKIM is one of three pieces. Check the SPF record for authorised sending servers and the DMARC record for the policy that requires one of them to align with your From address. The sending setup guide explains how they fit into preparing a domain for outreach.