Skip to main content
Emailens
Sign in

DKIM Checker

Looks up your DKIM public key at 17 common selectors, or the one you enter, and reads each key it finds: type, RSA length, and whether it is unreadable or revoked.

@emailens/engine 0.17.2 · data last changed 27 Oct 2026

The selector is the s= value in the DKIM-Signature header of an email you sent. Leave it empty to try the common ones.

Example: example.com, a made-up domain with a sample DKIM record. Check yours above.

passexample.com

Strong DKIM record (2048-bit RSA) active for selector(s): google.

DKIM signatures allow recipient mailboxes to verify that messages were genuinely authored by example.com and not modified in transit.

1 selector found

  • googlestrong2048-bit RSA

    2048-bit RSA or longer, or Ed25519.

    TXT google._domainkey.example.com

    v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAp06XivNW4/uBMImlwO8kNJns/rLvkhd1NMoC/ZZnaRbjQQ3XChlqA+7WBh5TRbvRiDGZymDednBHFiLIAP58P+A5htd0AXfXmkKdjMDgWM2rBHg799htYWyISrOf4o5Ev4Qnp0qgTNlDbnDI7sGrwEmgwyDuQnTAziJadfIAKRki+AeAo3OFTK+TmLPMKygfF8M45TcAu8yq9E13nyu0z1nUzy/E5SGXVYg9uqN2xXXDAG9FJK/ht2Y2k2qNyg8lc9IAjibHlhxaVTQZK8f7pWkYqW9uRnF81RHztwbazwodvQbRaxIvrsN6NNBzo11XzxXfm/9IZUT3cv4ur1LSFQIDAQAB

Selectors we tried (17)
  • google (found)
  • selector1
  • selector2
  • default
  • dkim
  • k1
  • k2
  • k3
  • mail
  • s1
  • s2
  • mandrill
  • pm
  • protonmail
  • smtp
  • resend
  • cf2024-1

Each name is looked up as a TXT record at selector._domainkey.example.com; a record with v=DKIM1 or a p= tag counts as found.

The checker needs a computer screen.

What each check reads

Probe
Looks up a TXT record at selector._domainkey on your domain for 17 common selector names, plus the one you enter. A record holding v=DKIM1 or a p= tag counts as found.
Key
Reads the k= tag (Ed25519, otherwise RSA) and, for RSA, the real modulus length out of the p= key rather than guessing from its length as text.
Strength
2048 bits or more, or Ed25519, is strong; 1024 to 2047 is legacy but accepted; under 1024 is too short; a p= that isn't a readable key is unreadable; an empty p= is a revoked key.
Verdict
A revoked key fails. Otherwise the worst key found sets a warning, named by its selector. Nothing found is a warning, not a fail: your selector may not be on the list.

A published key is half of it: to see whether a real message's signature passed, paste its headers into the email header analyzer. Then check SPF and DMARC.

Your next question

Other free tools: BIMI Checker · DMARC Report Reader · DMARC Record Generator · Email Header Analyzer · Email Spam Checker

Run this check on every email

A free account re-checks your records every day (1 monitored domain) and emails you when one changes: Watch your domain daily, free.

SPF, DKIM and DMARC monitoring (Dev). Dev is $9 a month. For one developer: 100 checks a day, an API key and a test inbox. See the plans →

Questions

What does a DKIM checker check?

This one looks up the DKIM public key your domain publishes in DNS, at selector._domainkey.yourdomain, for 17 common selectors and any selector you enter. For each key it finds it reads the type (RSA or Ed25519), measures the RSA key length, and flags keys that are too short, unreadable or revoked. It checks the published key, not a signature on a real message.

What is a DKIM selector and how do I find mine?

The selector is the name a sending service publishes its key under, so one domain can hold keys for several services. Open an email you sent, show its original headers and find the DKIM-Signature header: s= is the selector and d= is the domain the key lives on. The record is at s._domainkey.d.

Why does the checker find no DKIM record?

DNS can't list a domain's selectors, so a checker has to guess names. If your service signs with a name that isn't among the common ones, nothing turns up even though DKIM works. Enter the selector from the s= tag of one of your emails. If that finds nothing either, the key isn't published on that domain.

Is a 1024-bit DKIM key still OK?

Mail signed with a 1024-bit RSA key still passes at Gmail, Yahoo and Microsoft; 2048 bits is the recommended length. Gmail treats keys under 1024 bits as no signature at all. You don't set the length in DNS: the service that signs your mail issues the key, so generate a 2048-bit one there if it offers it and replace the record.

What does an empty p= in a DKIM record mean?

RFC 6376 reads an empty p= as a revoked key: receivers fail every signature made with that selector. It's the right way to retire a selector nothing sends with any more. If a service still signs with it, publish its current key there.