DKIM Checker
Find and validate DKIM public keys by trying common selectors or the one you provide.
Where a pasted header is read
The header is read on a separate page that runs no third-party code and sends nothing; only the domain and the selector come back here.
About the dkim checker
DKIM (DomainKeys Identified Mail, RFC 6376) lets a sending domain cryptographically sign outgoing messages. The signature is added as a DKIM-Signature header, and the matching public key is published in DNS as a TXT record at selector._domainkey.yourdomain.com. A receiving server fetches that key and verifies the signature to confirm the message was not altered after it was signed and genuinely came from that domain.
The selector is a short name chosen by whoever configured DKIM signing, and it is not discoverable from DNS alone since there is no standard place that lists a domain's selectors. This tool tries a large set of selectors used by common providers, such as google, selector1, s1 and k1, and also accepts a selector you supply directly if you know it.
Once a key is found, the tool checks its key length and algorithm. 2048-bit RSA is the current recommendation, and 1024-bit is the floor rather than a failure: mail signed with a 1024-bit key still verifies, so we warn rather than fail and tell you to rotate. Below 1024 bits is a different matter — RFC 8301 requires verifiers to treat such a key as invalid, so those signatures do not weakly pass, they produce a permanent error. It also verifies the record's syntax, since a malformed p= tag or an unintentionally empty key (which signals a revoked key) will cause every signature using that selector to fail. A domain can publish several selectors at once, which is normal when more than one sending platform is in use, and each one is validated independently since a failure in one selector does not affect mail signed with another.
Common questions
- What is a DKIM selector?
- A name that points to a specific public key, for example google in google._domainkey.example.com. Your mail provider's setup instructions tell you which selector to use.
- Why can't the tool find my selector?
- Selectors are not discoverable through DNS unless they use a common name. Enter yours manually, or copy it from a sent message's DKIM-Signature header, where it appears in the s= tag.
- How long should the key be?
- 2048-bit RSA is the current recommendation. A 1024-bit key still verifies, so it is a warning rather than a failure, but it should be rotated. Anything below 1024 bits is invalid under RFC 8301 and its signatures fail outright.
- What does a t=y tag mean?
- Testing mode: it asks receivers not to treat a failed signature from this selector as meaningful. It is meant to be removed once setup is confirmed, and one left behind by a setup wizard quietly weakens DKIM for as long as it is published.
- What does an empty p= tag mean?
- An empty p= value is the standard way to revoke a DKIM key while keeping the selector record in place, which deliberately makes every signature using that selector fail validation.
What this tool checks (7 rules)
- email.dkim.key-1024-bit — DKIM key is only 1024 bits
- email.dkim.key-revoked — DKIM record has an empty p= tag (key revoked)
- email.dkim.key-too-short — DKIM key is shorter than 1024 bits
- email.dkim.no-selector-found — No DKIM key found at the selectors checked
- email.dkim.syntax-invalid — DKIM record cannot be parsed
- email.dkim.testing-flag-set — DKIM record is in testing mode (t=y)
- email.dkim.unsupported-algorithm — DKIM key uses an algorithm receivers reject