Check a domain's DKIM key
Type a domain and, if you know it, the DKIM selector. We look the key up live, or try the common selectors, and check the version, key type, key length, revoked keys and testing mode. Free, no account.
How a result reads
A sample record, not a live lookup. Type your domain above to check yours.
This sample key is RSA 1024-bit in testing mode: it works, but rotate it to 2048 bits and remove t=y.
- Version: v=DKIM1
- Key type: RSA
- Key length: RSA 1024-bit. Accepted, but RFC 8301 says signers should use 2048 bits. Rotate to a 2048-bit key.
- Testing mode: t=y: the domain says it is testing DKIM, and receivers may treat a failed signature as no signature. Remove t=y once mail verifies.
v=DKIM1; k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDV4uwtXZtN6QfSt8XouITrWg/SxgEbUBhofpjiMg0ORIDLOpPyzq/cWRtMcaVNQZQ689A3LRzxnsqjMOXnsco90F6g/Dx6ohZZokQaOiHYiy3y0Qy1EjBK1cT4N252581sJ47OtQAYYoVPO/flSKqL9H8rVlazWw1pJHkNRhXNsQIDAQAB
How it works
A DKIM key is a TXT record at <selector>._domainkey.<domain>. With a
selector we make one live DNS query for it; without one we query the 24
selectors below at once, inside one 6-second budget. Names are checked before any
query, private and reserved names are refused, and nothing is stored.
Each key found is checked for the version (v=DKIM1), the key type (rsa or ed25519), the key length read from the key itself, an empty p= (a revoked key), testing mode (t=y) and SHA-1-only hashing, against RFC 6376 and RFC 8301.
Default selectors by provider
| Selector | Usual sender |
|---|---|
| Google Workspace | |
| selector1 | Microsoft 365 |
| selector2 | Microsoft 365 |
| k1 | Mailchimp / Mandrill |
| k2 | Mailchimp / Mandrill |
| s1 | SendGrid |
| s2 | SendGrid |
| zoho | Zoho Mail |
| zmail | Zoho Mail |
| protonmail | Proton Mail |
| protonmail2 | Proton Mail |
| protonmail3 | Proton Mail |
| fm1 | Fastmail |
| fm2 | Fastmail |
| mailjet | Mailjet |
| mandrill | Mandrill |
| everlytickey1 | Everlytic |
| everlytickey2 | Everlytic |
Many sending tools give each customer their own selector, so a miss here is not proof DKIM is off. The s= tag in the DKIM-Signature header of an email you sent names the selector for certain.
Get 67 leads free No card. Search free with contacts masked.
SPF, DMARC and MX checkerEmail provider lookupList-Unsubscribe checkerEmail warmup schedule
Questions
Look up the TXT record at selector._domainkey.yourdomain. Enter your domain above; without a selector we try the common ones such as google (Google Workspace) and selector1 (Microsoft 365).
Open an email you sent, show the original message, and find the DKIM-Signature header. The s= tag is the selector and the d= tag is the signing domain.
2048-bit RSA. RFC 8301 requires at least 1024 bits and says signers should use 2048.
The key has been revoked. Mail signed with that selector fails DKIM; publish a new key or stop signing with that selector.
Testing mode. Receivers may treat a failed signature as if the message were unsigned. Remove it once your mail verifies.
More free tools
Local business counterNo-website business finderLead list previewCold email template generatorUTM builderWebsite pricing calculatorFollow-up sequence generatorCold call script generatorAll tools