DKIM Checker
Look up a DKIM selector for any domain, verify the public key is published correctly, and see whether the key is strong enough.
Common selectors: google, selector1, selector2, default, mail, dkim, s1, s2, k1, mandrill, sendgrid. Find yours in a message header — look for the s= value in the DKIM-Signature line.
What DKIM does that SPF cannot
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every outgoing message. Your mail server signs the headers and body with a private key; the matching public key lives in DNS at selector._domainkey.yourdomain.com. A receiver fetches that key, verifies the signature, and knows two things SPF can never tell it: the message genuinely came from a system holding your key, and it was not altered on the way.
That second property is why DKIM survives forwarding. When a message is forwarded, the sending server changes — SPF fails — but the signature still verifies, so a forwarded message can still pass DMARC through DKIM alone. Any domain that relies on SPF only will watch legitimate forwarded mail fail authentication.
Finding your selector
The selector is the one awkward part of checking DKIM: it is chosen by each sending service, and a domain usually has several — one per service. Send yourself a message from the service, open the full headers in your mail client ("Show original" in Gmail), and find the DKIM-Signature line. The s= value is the selector and the d= value is the signing domain. No message handy? Try the common selectors listed under the form — Google Workspace uses google, Microsoft 365 uses selector1 and selector2.
Key length: the silent weakness
A 1024-bit RSA key was fine in 2012. It is factorable by a motivated attacker today, and several large receivers treat short keys with suspicion. 2048-bit is the current baseline. Rotating a DKIM key is not scary: generate a new key pair under a new selector, publish it, switch the signer, and remove the old record once mail in flight has cleared. Our checker estimates the published key's size from the record so you can see where you stand.
DKIM Checker — frequently asked questions
The checker says no record, but the service claims DKIM is on. Why?
Usually a wrong selector, or the record was published as a CNAME that has not propagated. Confirm the exact selector from a real message header and check again in 15–30 minutes.
Can one domain have multiple DKIM selectors?
Yes — that is normal and expected. Each sending service gets its own selector so keys can be rotated independently.
Does DKIM affect deliverability by itself?
A valid DKIM signature aligned with your From domain is one of the strongest positive signals receivers use, and it is required alongside SPF for DMARC. Unsigned mail from a domain that normally signs looks suspicious.
What does an empty p= tag mean?
The key has been revoked — the public key was deliberately withdrawn. Any mail still being signed with the matching private key will fail. It is the correct final step when retiring a key, and a red flag if you did not do it on purpose.