DKIM Checker
Find a domain's DKIM keys, read their public key strength, and catch revoked or test-mode selectors.
How DKIM works
DKIM signs each outgoing message with a private key held by your mail server. The matching public key lives in DNS. A receiver reads the signature header, fetches the public key, and checks that the message was not forged or altered in transit.
The signature header names a selector, and the receiver looks the key up at
<selector>._domainkey.<domain>.
Selectors let one domain publish many keys — a separate one for your CRM, your invoicing system,
and your marketing platform, plus a spare during key rotation.
Why you cannot simply list a domain's DKIM keys
There is no DNS query that enumerates selectors. You can ask "what is at
google._domainkey.example.com",
but you cannot ask "what selectors does example.com have". A checker must therefore guess.
This tool probes roughly 45 selectors that the major providers use by convention —
google for Workspace,
selector1 and
selector2 for Microsoft 365,
k1 for Mailchimp, and so on.
If it finds nothing, that is genuinely inconclusive rather than a clean bill of health, and the
result says exactly that. Enter your own selector to check it directly.
What to look for
- Key size — 2048 bits is the standard. 1024 still works but should be rotated. Below 1024, Gmail rejects the signature outright.
- Revoked keys — an empty
p=retires a selector. Mail still signed with it will fail. - Testing mode —
t=ytells receivers to ignore failures, which defeats the point once you are live. - Unparseable keys — usually a DNS provider that split the long record and inserted spaces or quote marks.
DKIM alone does not stop spoofing — a message can be validly signed by an attacker's domain. Pair it with SPF and enforce both with a DMARC policy.
Frequently asked questions
What is a DKIM selector?
A selector is a label that points to one specific public key, published at <selector>._domainkey.<domain>. It exists so a domain can run several keys at once — one per sending service, or an old and a new key during rotation. Your email provider chooses the selector and shows it in their dashboard.
Why does this tool guess selectors?
Because DNS provides no way to list them. Given a domain, there is no query that returns 'here are all the DKIM selectors'. You can only ask about a selector you already know. So this tool probes about 45 selectors that Google, Microsoft, Zoho, Proton, SendGrid, Mailchimp, Postmark and others use by default.
The tool found nothing. Does that mean I have no DKIM?
No — and this is important. It means you do not use one of the common selectors we probe. Finding nothing is not proof of absence. Look up your selector in your email provider's DNS settings and enter it directly in the selector field above.
What key size should I use?
2048 bits. 1024-bit keys still verify and remain common, but 2048 is the current standard and what you should rotate to. Anything below 1024 bits is considered broken and is rejected outright by Gmail and other major receivers, so a 512-bit key means your DKIM is effectively off.
What does an empty p= tag mean?
An empty public key explicitly revokes that selector. It is how you retire a key: publish p= with no value so any message still signed with the old key fails DKIM rather than silently passing. Once you are certain no mail uses the selector, remove the record entirely.
What is testing mode (t=y)?
t=y tells receivers to treat a DKIM failure as though the message were unsigned, rather than penalizing it. It is meant for the first days of a new setup. Left in place, it removes most of DKIM's value — so remove it once you have confirmed that signing works.
More free tools
Email Checker
Validate syntax, MX and disposable status for any address.
MX Lookup
See which mail servers receive a domain's email.
SPF Checker
Parse SPF and count the RFC 7208 DNS lookups.
DMARC Checker
Inspect your DMARC policy and reporting setup.
Disposable Checker
Detect throwaway and temp-mail domains.
Blacklist Checker
Check an IP or domain against DNS blocklists.
Need to verify a whole list?
This tool stops at DNS. The Mailvalid API confirms whether an individual mailbox actually exists over SMTP — in bulk, with 95%+ accuracy. Start with 100 free credits, no credit card.