DKIM · RFC 6376
DKIM Record Checker
Fetch a DKIM key by selector and domain, decode the public key to measure its length, and flag revoked, test-mode or broken records. Don’t know the selector? Scan the common ones.
Lookup
How to use the DKIM checker
Every DKIM key lives at <selector>._domainkey.<domain>. Enter both parts and press Check key. The checker fetches the TXT record, following CNAMEs (Microsoft 365 and many sending services delegate keys that way), joins its quoted chunks and decodes the base64 public key to read the key type and size from the key data itself.
Finding the selector
Open a message from the domain, find its DKIM-Signature header and read the s= tag; d= is the domain. The header analyzer shows both and links straight here. Without a message, Scan common selectors tries about 40 names used by popular providers, a few at a time. A scan can prove that a key exists, never that one is missing, because a selector can be any name.
What gets flagged
- RSA keys under 1024 bits fail (RFC 8301); 1024-bit keys still verify, but 2048 bits is the recommendation.
- An empty
p=means the key was revoked, so mail signed with it fails. t=ymarks a test key that receivers are asked not to treat strictly.- Truncated or garbled keys, usually from a record copied without all of its quoted parts.
Frequently asked questions
How do I find my DKIM selector?
Send yourself a message and look at the s= tag in its DKIM-Signature header, or open the DKIM settings of your email provider. Google Workspace uses google by default, and Microsoft 365 uses selector1 and selector2.
Is a 1024-bit DKIM key still acceptable?
It still verifies everywhere, but 1024-bit RSA is considered weak against well-funded attackers. Rotate to a 2048-bit key when your provider allows it; most do.
Why does the scan not find my key?
The scan only tries common names. If your provider generated a random selector, as Amazon SES and many marketing platforms do, read it from a message header or from the DNS instructions your provider gave you.
What does a CNAME in the result mean?
The selector is an alias that points to a record hosted by your provider, so they can rotate keys without you editing DNS. That is normal, and providers such as Microsoft 365 set DKIM up this way.