Free tool

DKIM checker

Finds the key you sign your email with, measures its bits and tells you whether it's revoked or in testing.

Try

Don't know your selector? Leave it empty and we'll try the 36 most common ones. It's in s=, in the DKIM-Signature header of an email you've sent.

Reference

How it works and how to read it

DKIM signs each email with a private key that only the sender has. The receiving server looks up the public key in your DNS and checks that the signature matches: that way it knows the message is yours and nobody has tampered with it.

The selector

The signature says where to find the key

Every signed email carries a DKIM-Signature header with the signing domain (d=) and the selector (s=). The receiving server combines the two and asks your DNS for the key. Without the selector there's no way to request it, so we try the ones the most common providers use.

DKIM-Signature header

example

v=1; a=rsa-sha256

version and algorithm

d=tudominio.com

the signing domain

s=google

the selector: Google Workspace

bh=… b=…

the message hash and the signature

The key is at google._domainkey

The key

A public key in a TXT record

The record holds the public key in p= and, sometimes, a setting or two. The private key stays on the signing server and is never published. Many providers publish it with a CNAME to their own zone so they can change it without asking you for anything.

Anatomy of a DKIM key

example

v=DKIM1

version

k=rsa

key type

p=MIIBIjANBgkqhkiG9w0B…

the public key, in base64

2048 bits

t=y

test mode: remove it when you're done

The size

How many bits your key has

A short key can be broken, and the standard (RFC 8301) requires RSA keys under 1024 bits to be rejected. Today 2048 is recommended. If your provider publishes the key for you with a CNAME, they manage it: what you can do is ask them for a 2048-bit one.

Key size

512-bit RSA

rejected: the signature isn't valid

1024-bit RSA

the minimum: worth upgrading

2048-bit RSA

recommended today

Ed25519

modern, but not everyone checks it

FAQ

What is DKIM?

It's a signature that the server sending your email adds to each message using a private key. The receiving server looks up the public key in your DNS and checks that the signature matches: that way it knows the message comes from whoever controls your domain and that nobody changed it along the way. Unlike SPF, the signature travels inside the message, so it usually survives forwarding.

How do I find my DKIM selector?

Open an email you've sent, show the original (in Gmail, “Show original”) and look for the DKIM-Signature header. The value of s= is the selector and the value of d=, the signing domain. Some common ones: google on Google Workspace, selector1 and selector2 on Microsoft 365, default on cPanel, fm1 on Fastmail and k1 on Mailchimp.

Why can't you find my key?

Because DKIM has no index: the key sits at a name that only someone who knows the selector can find. We try the ones used by the most common providers, but some services generate a different one for each domain. If you know yours, type it in the selector field: we then read it directly from your DNS servers, so it works even if you've only just published it.

Should I use a 1024-bit or a 2048-bit key?

2048 whenever you can. 1024 is the minimum the standard accepts and still works, but it's no longer recommended. A 2048-bit record is longer than the 255 characters that fit in a TXT string, so it's split into quoted chunks: that's normal and the server reading it joins them back together.

If the key is published, am I already signing my emails?

Not necessarily. The record only says the key exists; signing is up to the sending server, and with many providers you have to enable it separately after publishing it. To find out whether your email goes out signed, check that the headers of a sent message show dkim=pass with your domain, or send it to our email test.