Home / DKIM Checker
DKIM Record Checker
Find a domain's DKIM keys by scanning common selectors, or test your own selector, and see whether each key is active.
About DKIM Checker
A DKIM checker finds the public keys a domain publishes for DomainKeys Identified Mail, the signature that proves an email was sent by the domain and was not changed on the way. Keys are stored at a name built from a selector, so this tool tries over 30 selectors used by common providers and lets you enter your own. For each key it shows the type, an estimate of the RSA key size, and whether the key is active, revoked or in testing mode.
How DKIM records work
A mail server signs each message with a private key and adds a DKIM-Signature header naming the domain (d=) and the selector (s=). The receiver fetches the public key from the TXT record at selector._domainkey.domain and checks the signature. Using selectors lets a domain run several keys at once, one for each service, and rotate them without downtime.
Selectors this checker tries
Common ones include google (Google Workspace), selector1 and selector2 (Microsoft 365), k1 and k2 (Mailchimp and others), s1 and s2, fm1 to fm3 (Fastmail), protonmail to protonmail3 (Proton), zoho and zmail (Zoho), and default. If yours is not found, read the s= value from the DKIM-Signature header of a message you sent and enter it.
Reading a DKIM record
| Tag | Meaning |
|---|---|
| v=DKIM1 | Version, if present must come first |
| k= | Key type, rsa when missing |
| p= | The public key. Empty means the key is revoked |
| t=y | Testing: receivers treat signed mail like unsigned mail |
Sources: RFC 9989 (DMARC), RFC 7208 (SPF), RFC 6376 (DKIM), RFC 8461 (MTA-STS), Google email sender guidelines.
Frequently asked questions
How do I find my DKIM selector?
Open the headers of an email you sent and find the DKIM-Signature header. The s= value is the selector and d= is the domain. Enter both above. The checker also scans over 30 selectors used by common mail services, so it often finds the key without one.
Why does the DKIM check find nothing?
DKIM keys live at selector._domainkey.yourdomain, and DNS has no way to list them, so a key can only be found by name. If your provider uses a custom or date-based selector, enter it in the selector box. A domain that does not send mail at all may have no DKIM keys.
What does a revoked DKIM key mean?
A DKIM record with an empty p= value means the key has been revoked, according to RFC 6376. Signatures made with that selector fail. It is normal for an old selector to be revoked after a key rotation, as long as a current selector is active.
What DKIM key size should I use?
Use a 2048-bit RSA key where your provider supports it. The checker estimates the size of each RSA key from the length of its published public key.