DKIM checker: key and selector lookupDKIM record check
Finds your DKIM signing key in DNS, reads its type and length, and flags keys that are weak, stuck in test mode or revoked.
What this check looks at
- The selector you enter, or 44 common ones
- Key type and length (RSA / Ed25519)
- Test flag (t=y) and revoked keys
- CNAME delegation to a provider
- Allowed hash algorithms (h=)
What it reads and what it doesn't
DNS only: the TXT and CNAME record at the selector you enter, or at common selectors. DNS doesn't allow listing selectors, so without one only well-known names can be tried. No email is sent.
What is DKIM?
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message you send. The receiving server checks it against the public key you publish in DNS at selector._domainkey.yourdomain. If the signature verifies, the message wasn't altered in transit and really came from your server. Keys must be at least 1024 bits; 2048 bits is the recommended size.
DNS only: the TXT and CNAME record at the selector you enter, or at common selectors. DNS doesn't allow listing selectors, so without one only well-known names can be tried. No email is sent.
How to read the result
- Selector
- One domain can publish several keys, each under its own name: the selector. In the headers of an email you sent, the s= value of the DKIM-Signature line is the selector and d= is the domain.
- RSA 2048 / 1024
- 2048-bit RSA is the recommended size. 1024-bit keys are still accepted, but providers recommend moving to 2048. Anything below 1024 is not verified, per RFC 8301.
- Ed25519
- A newer, shorter and stronger key type (RFC 8463). Not every receiver verifies it yet, so it is published alongside an RSA key.
- CNAME →
- Providers such as Microsoft 365 and SendGrid keep the key in their own DNS. Your record points there, and the provider serves and rotates the key.
Common problems and how to fix them
Every issue this check can flag, why it matters and what to change in DNS.
No key at common selectors
Why it matters: That doesn't mean you have no DKIM: your provider may use a different selector. But if there's no key at all, your mail goes out unsigned.
What to do: Open the headers of an email you sent, copy the s= value from the DKIM-Signature line into the selector box and check again. If there's no such line, turn on DKIM in your provider's admin.
No DKIM record at the selector
Why it matters: Mail signed with this selector can't be verified, so DKIM fails for DMARC.
What to do: Turn on DKIM in your email provider's admin and add the TXT or CNAME record it gives you under exactly this name: …._domainkey. Check the spelling and the domain at the end.
selector1._domainkey.example.com. CNAME selector1-example-com._domainkey.example.onmicrosoft.com.Key shorter than 1024 bits
Why it matters: RFC 8301 says verifiers must not consider signatures made with keys under 1024 bits valid. Short keys can be broken.
What to do: Generate a new key of at least 2048 bits, publish it under a new selector, switch signing to it and revoke the old key by emptying p=.
1024-bit RSA key
Why it matters: 1024 bits is still accepted, but Google and other large providers recommend 2048.
What to do: If your provider supports it, generate a 2048-bit key and move to a new selector. A long key doesn't fit in one TXT string; most DNS panels split it for you.
Test mode on
Why it matters: t=y tells receivers the key is being tested; some ignore signature failures.
What to do: If verification works, remove the t=y tag from the record.
SHA-1 only
Why it matters: RFC 8301 says rsa-sha1 signatures must not be used or verified.
What to do: Remove the h= tag or set it to sha256, and switch your provider's signing algorithm to rsa-sha256.
Frequently asked questions
- How do I find my DKIM selector?
- Open an email sent from your domain and view the original headers (Show original in Gmail, Message details in Outlook). In the DKIM-Signature line, s= is the selector and d= is the signing domain.
- Should a DKIM key be 1024 or 2048 bits?
- Use 2048-bit RSA. 1024 bits is still accepted but shouldn't be used for new setups. Some DNS panels reject TXT values over 255 characters; if yours doesn't split a 2048-bit key automatically, split it into two quoted strings.
- Why can't you find my DKIM record?
- DNS doesn't let anyone list the selectors on a domain, so without the selector it can only be guessed. We try 44 common ones. If your provider uses a different name, type it into the selector box.
- Does DKIM stop spoofing on its own?
- No. DKIM says whether a signature is valid, but DMARC decides what happens to unsigned spoofed mail. Use DKIM together with DMARC p=quarantine or p=reject.
Primary sources
More quick checks
Each one answers a single question about a single record. No account needed.
SPF record check
Expands your domain's SPF record through every include, counts the DNS lookups it spends and flags the mistakes that send your mail to spam.
DMARC record check
Breaks your DMARC record down tag by tag: what happens to spoofed mail, where reports go and whether external report addresses are authorized.
MX lookup
Shows which servers receive email for your domain, in priority order, with each server's address, reverse DNS and provider.
Is it down?
Tries to open the site from two separate locations and tells you whether it's down for everyone or just for your connection.
SSL expiry check
Shows when your certificate expires, how many days are left and who issued it. Checks the apex and www separately and adds a calendar reminder.
To see every check in one report:Email security check