DKIM checker: the keys a domain signs its email with

DKIM lets a domain sign its email with a key published in DNS, so receivers can check that a message comes from that domain and wasn’t altered. Each key sits under a name called a selector. Type a domain and, if you know it, the selector; without one we try 33 common selectors.

Add as a preferred source Download onGoogle Play Download onApp Store

The selector is the “s=” value of the “DKIM-Signature” header of an email sent by that domain. Leave it empty to try the common ones.

How to find the selector

Open an email sent by that domain and show its original or its headers (in Gmail: the three dots, then “Show original”).
Find the “DKIM-Signature” header: “d=” is the domain and “s=” is the selector, for example s=selector1.
Type the domain and the selector and press “Check DKIM”. Without a selector we try 33 common ones, such as default, google, selector1 or k1.

What each result means

The domain signs its email with DKIM: We found its public key: receivers can check that its messages come from this domain and weren’t altered on the way.
There are DKIM keys, with warnings: We found at least one key, but some are retired, in testing or too weak. The details are under each key.
No DKIM key at the common selectors: That doesn’t prove the domain has no DKIM: it may use another selector. You’ll find it in the “DKIM-Signature: s=” header of an email it sent you. Type it in “Selector” and check again.
No DKIM key at that selector: Check how it’s written: the selector is the “s=” value of the “DKIM-Signature” header, and the domain is its “d=” value.

What each signal means

The key is empty (p=): this selector is retired and no longer signs email.
The key is in testing mode (t=y): the domain asks receivers not to act when the signature fails.
The RSA key is shorter than 1024 bits: it can be broken and many receivers don’t accept it.
The RSA key has 1024 bits: still accepted, but 2048 is recommended.
The key only allows SHA-1, an old algorithm that’s no longer considered safe.
The key record has an error and can’t be read.
The key type isn’t RSA or Ed25519, so receivers can’t use it.
There’s no key at any of the selectors we tried.

Which countries it covers

Works with domains from any country. Without a selector we try the defaults of the big providers (Google, Microsoft 365, Zoho, Proton, Fastmail, Mailchimp and others) and the usual generic names, 33 in total. Keys are read as receiving servers do (RFC 6376): RSA and Ed25519.

We read the domain’s public DNS records. If you type an email address or a link, only its domain leaves your browser. The domain you look up isn’t stored.

Frequently asked questions

What is DKIM?

DomainKeys Identified Mail: the sending server signs each email with a private key and the domain publishes the public key in DNS. The receiving server checks the signature: if it matches, the email comes from that domain and wasn’t changed on the way.

What is a selector?

The name a key is published under, at selector._domainkey.example.com. A domain can have several, one per provider or per key change. It appears as “s=” in the “DKIM-Signature” header of each email.

Why doesn’t it find a key when the domain uses DKIM?

Selectors can have any name and DNS can’t list them. We try 33 common ones; if the domain uses another, type it in “Selector”. That’s why “not found” doesn’t prove there’s no DKIM.

What do 1024 and 2048 bits mean?

The size of the RSA key: the longer, the harder to break. 1024 bits is still accepted, but 2048 is what’s recommended. Below 1024, many receivers ignore the signature.