DKIM checker
Find a domain's DKIM keys at common selectors or your own, and read each key's type and length.
A DKIM checker looks up the public key at selector._domainkey.yourdomain.com and reads its type and length. Whoever signs your mail picks the selector, and DNS cannot list a domain’s selectors, so a checker can only try names: this one tries 41 common selectors plus any you type. RFC 8301 requires RSA keys of at least 1024 bits and says signers should use 2048.
Last verified . The sources named on this page were read that day.
DKIM checker, the tool
Sample report. kestrel-labs.example is a made-up domain
Warning
DKIM key found at google: 1024-bit RSA key. RFC 8301 says signers should use at least 2048 bits.
Looked up <selector>._domainkey.kestrel-labs.example (TXT)
google._domainkeyWarning
1024-bit RSA key. RFC 8301 says signers should use at least 2048 bits.
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPi1l/O8QP/cWAUUquimfzlxZgGgSmLY8XDXbAhifAPb155p7B4Hk65KL1eduQlDloJhSx/JEkd9aiDV9Bx1exA/iE9ps624NpQIQfwJO5dMKoOshSciKFeOfW6uL+LtFQLVceB5BfHULdv1YDfArlSg5VaEPNHWbuyHZPj+HOnQIDAQAB
Tags
- The MX records point to Google Workspace. Google Workspace's default selector is google.
The 41 selectors we tried
defaultgoogleselector1selector2k1k2k3s1s2m1maildkimsmtpsmtpapimandrillmte1mte2mxvaultmailomxpickrspdk1pdk2pmpostmarksendgridmailgunamazonsessesfdzohozmailbrevofm1fm2fm3protonmailprotonmail2protonmail3sig1
The rest of the report
- SPFFailSPF needs 11 DNS lookups and the limit is 10, so receivers return a permanent error and SPF fails.
- DMARCWarningDMARC is at p=none, which makes no request about failing mail. Once reports show all your senders pass, move to quarantine.
- MXPass1 MX host, and it resolves. Mail is hosted by Google Workspace.
- BIMINot foundNo BIMI record. BIMI is optional, and it needs DMARC at quarantine or reject before any inbox shows a logo.
- MTA-STSNot foundNo MTA-STS record. It is optional; it tells senders to refuse delivery without verified TLS to your listed MX hosts.
- BlocklistsCould not checkNot listed on the 14 queries that answered. Spamhaus DBL could not be checked from our server.
How selectors work
A domain can publish several keys at once, one per sending service, each under its own selector. To find yours, open a message you sent in its original form and read s= in the DKIM-Signature header.
In the message
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=s1; …The name the receiver builds
s1._domainkey.example.comThe TXT record it finds there
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0B…s=, the signing domain is d=, and _domainkey joins them (RFC 6376, section 3.6.2.1). For DMARC, d= has to share your From domain, so set up your own domain at each service that signs for you.Where to find your selector, by provider
| Provider | Selector | Source |
|---|---|---|
| Google Workspace | google, the default prefix | |
| Microsoft 365 | selector1, selector2 | Microsoft |
| Zoho Mail | Named by the admin, for example zoho | Zoho |
| Fastmail | fm1, fm2, fm3 | Fastmail |
| Proton Mail | protonmail, protonmail2, protonmail3 | Proton |
| iCloud+ custom domain | sig1 | Apple |
| Amazon SES | Three generated tokens, nothing to guess | AWS |
| Mailgun | Varies by domain, for example pdk1, pdk2 | Mailgun |
| SendGrid | s1, s2 | Twilio SendGrid |
| Mailchimp | k2 and a second CNAME | Mailchimp |
Where a provider publishes the key behind a CNAME, the checker follows it and reads the provider’s key.
Key length
- RSA
- At least 1024 bits for RFC 8301, Google and Yahoo; RFC 8301 and Google recommend 2048. A 2048-bit key is longer than one TXT string, so it is split into strings that receivers join.
- Ed25519
- A shorter key type from RFC 8463, which a signer can use beside RSA. The checker reports it without a length judgment.
Rotation
M3AAWG recommends rotating keys at least every six months: publish the new key under a new selector, switch signing to it, keep the old key for 7 to 30 days, then empty its p=. An empty p= means revoked, which the checker reports as the expected state for a retired selector.
Related tools
- SPF record checkerCheck a domain's SPF record and count its DNS lookups through every include against the limit of 10.
- DMARC checkerLook up a domain's DMARC record, see which policy applies to its mail, and build the next record to publish.
- Email domain checkerCheck a domain's SPF, DKIM, DMARC, MX, BIMI, MTA-STS and blocklist status, with the record to publish for each problem.