EN
Sign inRequest access
Menu

DKIM checker

Find the DKIM key of any domain without knowing its selector. We try the most common selectors, read the key length and tell you whether the key is missing, revoked or too short. If you know your selector, type it too. Free, with no sign-up.

Leave it empty to try the 36 common selectors. Your selector is the s= value in the DKIM-Signature header of a message you sent.

We read public DNS records only. If you type an email address, only the part after @ leaves your browser.

DKIM key of lumen-advisory.example

This is an example for a made-up domain. Type your own domain above to check it.

DNS for this domain is managed at Cloudflare. Make the changes there.

  • DKIMThe DKIM key at google._domainkey is only 1024-bit.Warning

    1024-bit keys still work, but 2048-bit keys are the current recommendation.

    What we found

    google._domainkey.lumen-advisory.example

    How to fix it

    Create a new 2048-bit key in your email provider's settings and publish it. Remove the old key once your mail is signed with the new one.

    Type
    TXT
    Name
    google._domainkey.lumen-advisory.example
    Value
    Your provider gives you the value.

    Many DNS panels want only the part before your domain: @ for the domain itself, _dmarc for DMARC.

Check MX, SPF, DKIM and DMARC together

DKIM signs each message with a key published in your domain's DNS.

DKIM (DomainKeys Identified Mail) adds a digital signature to every message you send. The receiving server reads the public key from your DNS and checks that the message comes from your domain and was not changed on the way.

DMARC passes when SPF or DKIM passes for your domain, and Gmail and Yahoo require DKIM from senders of large volumes. Unlike SPF, a DKIM signature still holds when a message is forwarded.

A DKIM key sits under a name that your email provider chooses.

The name is called a selector. The key is published at <selector>._domainkey.<your domain>, and every signed message names its selector in the s= value of its DKIM-Signature header.

These are the selectors we try when you leave the selector field empty:

  • google
  • selector1
  • selector2
  • default
  • dkim
  • mail
  • k1
  • k2
  • k3
  • s1
  • s2
  • smtp
  • mg
  • zoho
  • zmail
  • protonmail
  • protonmail2
  • protonmail3
  • fm1
  • fm2
  • fm3
  • mxvault
  • mandrill
  • mailjet
  • hs1
  • hs2
  • sig1
  • key1
  • key2
  • everlytickey1
  • everlytickey2
  • cm
  • dk
  • email
  • mta
  • x

Google Workspace and Microsoft 365 sign with your domain only after you switch DKIM on.

  1. Google Workspace

    In the Admin console, open Apps → Google Workspace → Gmail → Authenticate email. Generate a 2048-bit key, publish it as a TXT record at google._domainkey, then select Start authentication.

  2. Microsoft 365

    In the Microsoft Defender portal, open Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM. Publish the two CNAME records for selector1 and selector2, then switch signing on.

  3. Other providers

    Find DKIM in the provider's domain settings. It gives you a selector and a key to publish as a TXT record.

Use a 2048-bit key, and replace an old key without a gap.

Receivers accept 1024-bit keys, but 2048 bits is the current recommendation. Keys shorter than 1024 bits are not accepted.

To replace a key, publish the new one under a new selector, switch signing to it, and remove the old key a few days later, when no mail signed with it is still on its way.

Common questions about DKIM

What is DKIM?

DKIM is a way to authenticate email: your mail server signs each message, and receivers check the signature with the public key in your domain's DNS. It shows that the message comes from your domain and was not changed.

Why does the checker find no DKIM key?

Either DKIM is not switched on, or your provider uses a selector that is not on our list. Send yourself a message, open its headers and find s= in the DKIM-Signature header: type that value in the selector field.

Where do I find my DKIM selector?

In the DKIM-Signature header of any message you sent: the selector is the value after s=. Your email provider's DKIM settings also show it.

What does a revoked key mean?

A DKIM record with an empty p= value. It tells receivers that the key under that selector is no longer valid, so mail signed with it fails DKIM.

Is a 1024-bit DKIM key still enough?

It still works, but 2048 bits is the current recommendation. If your provider offers 2048 bits, use it when you next replace the key.

Can a domain have several DKIM keys?

Yes. Each service that signs mail for your domain uses its own selector, so a domain often has several keys at the same time.