Free DKIM checker, no signup. Enter a domain name and a selector to read the DKIM record, the key type and the key length. Leave the selector empty and the tool tries 27 common ones. The check runs in your browser against public DNS.
What This DKIM Checker Tells You
- The DKIM record published for a selector.
- The key type and length, such as RSA 2,048 bits.
- Whether the key is revoked (an empty
p=value). - Which common selectors answer, when you do not know the selector.
What a DKIM Selector Is
A domain can publish several DKIM keys, one for each service that sends its mail. The selector is the name that tells receivers which key to use. The record lives at selector._domainkey.example.com.
DNS cannot list the selectors of a domain. You have to know the name. That is why a DKIM check needs a selector and an SPF or DMARC check does not.
How to Find Your Selector
- Open a message sent from the domain.
- Show its full headers. In Gmail: the three-dot menu, then “Show original”.
- Find the line that starts with
DKIM-Signature. - Read the
s=value: that is the selector. Thed=value is the signing domain.
Selectors the Tool Tries
With no selector entered, the checker asks DNS for 27 common names: google, selector1 and selector2, k1 to k3, s1 and s2, default, dkim, mail and others. A domain whose selector is not on the list shows no result, even with DKIM working. Enter the selector to be sure.
How to Read a DKIM Record
| Tag | Meaning |
|---|---|
v=DKIM1 | Version. |
k= | Key type: rsa (the default) or ed25519. |
p= | The public key. Empty means the key is revoked. |
t=y | Testing mode: the sender is still trying DKIM out. |
Key Length
Receivers do not accept RSA keys shorter than 1,024 bits, and 2,048 bits is the recommended length (RFC 8301). If the checker shows 1,024 bits, ask your mail provider for a 2,048-bit key.
After the DKIM Check
A DKIM signature only protects the domain when a DMARC record asks receivers to act on it. Check that with the DMARC Checker, the sending servers with the SPF Checker, and read the SPF, DKIM and DMARC guide for how the three fit together.
Frequently Asked Questions
What is a DKIM record?
A DKIM record is a DNS TXT record that holds a public key. The sending server signs each message with the matching private key, and receivers use the record to check that the message was not altered and comes from the domain.
How do I check a DKIM record?
Enter the domain and its selector in the checker above. From a terminal, run dig txt selector._domainkey.example.com +short, replacing selector with the real name.
How do I find my DKIM selector?
Open a message sent from your domain, show its full headers and find the DKIM-Signature line. The selector is the value after s=. Your mail provider’s DNS setup page also lists it.
Can I check DKIM without a selector?
Only partly. DNS cannot list a domain’s selectors, so the tool tries 27 common ones. If yours is not among them, nothing shows, even when DKIM works. Enter the selector for a sure answer.
What DKIM key length should I use?
2,048-bit RSA. Receivers reject RSA keys shorter than 1,024 bits, and 2,048 bits is the length the standard recommends (RFC 8301).
What does a revoked DKIM key mean?
A record with an empty p= value means the key was withdrawn. Messages signed with that selector fail DKIM. Providers publish it on purpose when they rotate keys.