DKIM Checker

About the dkim checker

DKIM (DomainKeys Identified Mail, RFC 6376) lets a sending domain cryptographically sign outgoing messages. The signature is added as a DKIM-Signature header, and the matching public key is published in DNS as a TXT record at selector._domainkey.yourdomain.com. A receiving server fetches that key and verifies the signature to confirm the message was not altered after it was signed and genuinely came from that domain.

The selector is a short name chosen by whoever configured DKIM signing, and it is not discoverable from DNS alone since there is no standard place that lists a domain's selectors. This tool tries a large set of selectors used by common providers, such as google, selector1, s1 and k1, and also accepts a selector you supply directly if you know it.

Once a key is found, the tool checks its key length and algorithm. 2048-bit RSA is the current recommendation, and 1024-bit is the floor rather than a failure: mail signed with a 1024-bit key still verifies, so we warn rather than fail and tell you to rotate. Below 1024 bits is a different matter — RFC 8301 requires verifiers to treat such a key as invalid, so those signatures do not weakly pass, they produce a permanent error. It also verifies the record's syntax, since a malformed p= tag or an unintentionally empty key (which signals a revoked key) will cause every signature using that selector to fail. A domain can publish several selectors at once, which is normal when more than one sending platform is in use, and each one is validated independently since a failure in one selector does not affect mail signed with another.

Common questions

What is a DKIM selector?

A name that points to a specific public key, for example google in google._domainkey.example.com. Your mail provider's setup instructions tell you which selector to use.

Why can't the tool find my selector?

Selectors are not discoverable through DNS unless they use a common name. Enter yours manually, or copy it from a sent message's DKIM-Signature header, where it appears in the s= tag.

How long should the key be?

2048-bit RSA is the current recommendation. A 1024-bit key still verifies, so it is a warning rather than a failure, but it should be rotated. Anything below 1024 bits is invalid under RFC 8301 and its signatures fail outright.

What does a t=y tag mean?

Testing mode: it asks receivers not to treat a failed signature from this selector as meaningful. It is meant to be removed once setup is confirmed, and one left behind by a setup wizard quietly weakens DKIM for as long as it is published.

What does an empty p= tag mean?

An empty p= value is the standard way to revoke a DKIM key while keeping the selector record in place, which deliberately makes every signature using that selector fail validation.