DKIM checker

Purpose

Check a domain’s DKIM keys: type a selector or let us try the most common ones, and see each key’s type, its size in bits and whether it’s in testing or retired.

Requirements

Anyone can read these guides, no account needed. Some tools require Pro, as indicated in each guide.

DKIM lets a domain sign its email with a key published in DNS, so receivers can check that a message comes from that domain and wasn’t altered. Each key sits under a name called a selector. Type a domain and, if you know it, the selector; without one we try 33 common selectors.

How to use it

1. 1

   Open an email sent by that domain and show its original or its headers (in Gmail: the three dots, then “Show original”).

2. 2

   Find the “DKIM-Signature” header: “d=” is the domain and “s=” is the selector, for example s=selector1.

3. 3

   Type the domain and the selector and press “Check DKIM”. Without a selector we try 33 common ones, such as default, google, selector1 or k1.

Synthetic example

selector1._domainkey.example.com

Interpret the result

The domain signs its email with DKIM: We found its public key: receivers can check that its messages come from this domain and weren’t altered on the way.

There are DKIM keys, with warnings: We found at least one key, but some are retired, in testing or too weak. The details are under each key.

No DKIM key at the common selectors: That doesn’t prove the domain has no DKIM: it may use another selector. You’ll find it in the “DKIM-Signature: s=” header of an email it sent you. Type it in “Selector” and check again.

No DKIM key at that selector: Check how it’s written: the selector is the “s=” value of the “DKIM-Signature” header, and the domain is its “d=” value.

The key is empty (p=): this selector is retired and no longer signs email.

The key is in testing mode (t=y): the domain asks receivers not to act when the signature fails.

The RSA key is shorter than 1024 bits: it can be broken and many receivers don’t accept it.

The RSA key has 1024 bits: still accepted, but 2048 is recommended.

The key only allows SHA-1, an old algorithm that’s no longer considered safe.

The key record has an error and can’t be read.

The key type isn’t RSA or Ed25519, so receivers can’t use it.

Limitations

We read the domain’s public DNS records. If you type an email address or a link, only its domain leaves your browser. The domain you look up isn’t stored.

Troubleshooting

That doesn’t look like a public domain. Try something like example.com.

A selector can only have letters, numbers, hyphens, underscores and dots.

DNS didn’t answer in time. Try again in a few seconds.

You’ve run a lot of checks in a row. Wait a minute and try again.

Use with the API

A domain’s DKIM keys at a selector, or at about 33 common selectors when none is given: each key’s type (rsa or ed25519), size in bits and whether it is in testing or revoked. none_found does not prove the domain has no DKIM: it may use another selector. Nothing is stored.

Send the JSON body to the tool's own route, or to POST /v2/tools with the tool field added. Both routes return the same result.

POST https://api.nocall.io/v2/dkim-check
POST https://api.nocall.io/v2/tools  {"tool":"dkim-check","domain":"example.com","selector":"s1"}

REQUEST_ID="$(uuidgen)" && [ -n "$REQUEST_ID" ] &&
curl --request POST 'https://api.nocall.io/v2/dkim-check' \
  --header "Authorization: Bearer $NOCALL_API_KEY" \
  --header 'Content-Type: application/json' \
  --header "Idempotency-Key: $REQUEST_ID" \
  --data '{"domain":"example.com","selector":"s1"}'

import json
import os
import urllib.request
import uuid

api_key = os.environ.get('NOCALL_API_KEY')
if not api_key:
    raise SystemExit('Set NOCALL_API_KEY')

request = urllib.request.Request(
    'https://api.nocall.io/v2/dkim-check',
    method='POST',
    data=json.dumps({'domain': 'example.com', 'selector': 's1'}).encode(),
    headers={
        'Authorization': 'Bearer ' + api_key,
        'Content-Type': 'application/json',
        'Idempotency-Key': str(uuid.uuid4()),
    },
)
with urllib.request.urlopen(request, timeout=30) as response:
    result = json.load(response)
print(result['data']['result'], result['meta']['unitsCharged'])

import { randomUUID } from 'node:crypto';

const requestId = randomUUID();
const apiKey = process.env.NOCALL_API_KEY;
if (!apiKey) throw new Error('Set NOCALL_API_KEY');

const response = await fetch('https://api.nocall.io/v2/dkim-check', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer ' + apiKey,
    'Content-Type': 'application/json',
    'Idempotency-Key': requestId,
  },
  body: JSON.stringify({ domain: 'example.com', selector: 's1' }),
});
const result = await response.json();
if (!response.ok) throw new Error(result.error?.code ?? 'request_failed');
console.log(result.data.result, result.meta.unitsCharged);

{
  "data": {
    "tool": "dkim-check",
    "result": {
      "domain": "example.com",
      "domainAscii": "example.com",
      "selectorGiven": true,
      "selectorsTried": 1,
      "keys": [
        {
          "selector": "s1",
          "keyType": "rsa",
          "keyBits": 2048,
          "testing": false,
          "revoked": false,
          "valid": true,
          "signals": []
        }
      ],
      "signals": [],
      "attention": false
    }
  },
  "meta": {
    "requestId": "req_example",
    "unitsCharged": 1,
    "usage": {
      "periodStart": "2026-10-01",
      "unitLimit": 20,
      "unitsUsed": 3,
      "unitsRemaining": 17
    }
  }
}

• API reference ↗

Frequently asked questions

Related guides

• DMARC checker
• SPF record checker
• Is this email real?