DKIM Record Checker

Look up a DKIM public key and check its type, length and syntax. Don't know the selector? Leave it blank and we'll try the common ones.

Free, no account needed.

What this check looks at

The DKIM record at selector._domainkey.yourdomain, and whether it is a valid key record.
The key type and length: 1024-bit RSA keys still work but 2048-bit is recommended.
Revoked keys (an empty p= value) and test mode (t=y).
With no selector, probes selectors used by Google Workspace, Microsoft 365, SendGrid, Mailchimp, Amazon SES and others.

Finding your selector

Open any email you sent, view the original message or headers, and find the DKIM-Signature header. The s= value is the selector and d= is the signing domain. Our Email Header Analyzer shows this for you.

DKIM and DMARC

DKIM survives forwarding better than SPF, so it is the most reliable way to pass DMARC. For DMARC to count it, the d= signing domain must match your From domain. Make sure every service that sends as you signs with your domain, not the provider's.

Frequently asked questions

Why can't you find my DKIM key?

DKIM keys live under a selector that can be anything. If yours isn't one of the common ones, enter it after the domain. You can find it in the s= tag of the DKIM-Signature header of an email you sent.

Can I have more than one DKIM key?

Yes. Each sending service usually has its own selector, and you can publish as many as you need.

How often should DKIM keys be rotated?

Many organizations rotate every 6 to 12 months. Publish the new selector, switch signing to it, then remove the old key after a few days.