DKIM record checker

What this checks

DKIM signs every message you send; receivers check the signature against a public key you publish in DNS at selector._domainkey.example.com. The selector can be any name your mail provider picked, so there is no way to list every key a domain has.

• With a selector, the checker reads the record at that exact name and reports whether it exists, whether its p= key is valid, its type (RSA or Ed25519) and its size, and whether it is in testing mode (t=y).
• Without one, it tries the selectors common providers use, such as google (Google Workspace), selector1 and selector2 (Microsoft 365), k1 (Mailchimp) and s1/s2 (SendGrid), and reports each key it finds. If any made-up selector also answers, the domain has a wildcard record and selectors cannot be told apart from outside.

To find your selector, open a message you sent, view its headers and look for s= in the DKIM-Signature header: d= is the domain, s= is the selector.

Common problems and fixes

No record at the selector. The key was never published, or was published at the wrong name. Many DNS panels add the domain for you, so selector1._domainkey.example.com typed in full becomes selector1._domainkey.example.com.example.com. Enter only the part before your domain.

The key is not valid. Long keys are often cut short when pasted. Copy the whole value from your provider again; most panels split long TXT values into 255-character strings for you.

Empty p=. That marks a key as revoked. Mail signed with it fails DKIM.

1024-bit key. Still accepted, but 2048 bits is the recommended size; keys under 1024 bits are ignored (RFC 8301). Create a new key at a new selector, then retire the old one.

Set-up steps for the big providers are in the guides for Google Workspace and Microsoft 365. The email security check checks DKIM with SPF and DMARC, and the email test shows whether a real message passed.