DKIM Record Checker

What the DKIM checker looks at

DKIM public keys are TXT records at <selector>._domainkey.<domain>. Enter a selector to check one key. Leave it blank and the checker probes about 50 selectors that Google Workspace, Microsoft 365, Mailchimp/Mandrill, SendGrid, Amazon SES, Zoho, Proton, Fastmail and other providers commonly use. If a wildcard answers every selector, the checker says so and shows the wildcard record once.

• Tags: v (must be DKIM1 and first if present), k (rsa or ed25519), p (the key), h (hash algorithms), s (service type) and t (flags).
• Key size: the base64 key in p= is decoded and its RSA modulus length measured. RFC 8301 sets 1024 bits as the minimum and recommends 2048.
• Revoked keys: an empty p= means the key was withdrawn, and any signature that uses it fails.

Finding your selector

Open a message sent from the domain, view the original source and find the DKIM-Signature header. The s= value is the selector and d= is the signing domain. Microsoft 365 uses selector1 and selector2. Google Workspace uses google unless you changed it.

Common problems

• Key split wrongly: 2048-bit keys are longer than 255 characters and must be stored as several strings in one TXT record. Some DNS panels insert spaces or quotes that break the base64, and then the key cannot be decoded.
• 1024-bit RSA: it still verifies, but rotate to 2048 when your provider allows it.
• t=y left on: testing mode tells verifiers not to treat failures differently from unsigned mail. Remove it once signing works.
• h=sha1: SHA-1 signatures are no longer accepted. Allow sha256.

DKIM only protects your From address when DMARC is in place. Check that with the DMARC Record Checker.