DKIM Checker
This free DKIM checker finds a domain's DKIM public key, measures its strength and flags keys that are revoked, too short or still in test mode.
What is DKIM?
DKIM adds a cryptographic signature to every email you send. Receivers fetch your public key from DNS and use it to confirm the message really came from you and wasn't changed on the way.
The key lives in a TXT record at selector._domainkey.yourdomain, where the selector is a name your email provider chooses.
How to find your DKIM selector
Open an email you sent, view the original message or headers, and find the DKIM-Signature line. The value after s= is your selector.
Leave the selector empty and we'll try the most common ones, including google for Google Workspace and selector1 and selector2 for Microsoft 365.
Frequently asked questions
Is a 1024-bit DKIM key still OK?
It still works, but 2048-bit is the current recommendation. Most providers let you rotate to a 2048-bit key in a few clicks.
What does an empty p= mean?
An empty public key means the key has been revoked on purpose. Mail signed with that selector will fail DKIM.
Why can't the tool find my key?
Your provider probably uses a selector we don't guess. Enter it from the s= value of a DKIM-Signature header and check again.
Do I need DKIM if I already have SPF?
Yes. SPF breaks when mail is forwarded, and DKIM survives it. DMARC passes when either one aligns, so having both makes delivery far more reliable.