DKIM Checker

What DKIM does

DKIM adds a digital signature to every email you send. The receiving server looks up your public key in DNS and uses it to check the signature. If it matches, the receiver knows the message really came from a server you authorised and was not changed on the way.

The key lives in a TXT record at selector._domainkey.yourdomain.com. The selector is just a label that lets you have several keys at once, one per sending service or one per year.

Finding your selector

• From an email you sent: open the message source and find the DKIM-Signature header. The selector is the value after s=, and the domain is after d=. The Email Header Analyzer pulls both out for you.
• From your provider: Google Workspace uses google by default, Microsoft 365 uses selector1 and selector2, and most other services show the selector in their DNS setup instructions.

When you leave the selector blank, we try 32 common names. Many services use custom selectors, so "none found" does not prove that a domain has no DKIM.

What we check

• The record has a public key and it can be read.
• The key length: 2048-bit RSA is the current recommendation, 1024-bit is accepted but ageing, and anything shorter is ignored by many receivers.
• Testing mode (t=y), which you should remove once signing works.
• An empty key, which means the selector has been retired on purpose.

Limitations

We check the published key, not whether your mail server actually signs with it. To confirm that, send yourself a message and look at the DKIM result in its headers.

Questions