Why can a checker not find my DKIM record automatically?

DNS provides no way to list the selectors a domain uses, so any checker can only probe names it already knows about. We check the selectors published by the major providers. If yours uses a generated selector (Amazon SES does), no checker can find it without being told the name.

How do I find my DKIM selector?

Open a message you sent recently and look at its DKIM-Signature or Authentication-Results header. The s= value is your selector. Enter it above to check that specific record.

Free toolDKIM

DKIM record checker

Check a DKIM selector for a domain, validate the record, and read the key strength. Leave the selector blank to probe the selectors common providers use.

Run the checkFree · no account

Problems this finds

Your email's digital seal has been switched off: The seal was deliberately withdrawn, which is normal when replacing it. But if your emails still use it, they fail the check and are more likely to land in spam or be rejected.
Your email's digital seal could be upgraded to a stronger one: It works today and receivers accept it. Stronger seals are now the standard, so switching the next time you're making changes is a small, sensible upgrade.
Your email's digital seal is too weak to trust: It uses an outdated, short code that can be cracked, which would let scammers make fake emails look sealed by you. Some receivers already refuse it. Your email provider can issue a stronger one.
Your email's digital seal is damaged and can't be read: The setting was likely cut short or had spaces added when it was pasted. Every email sealed with it fails the check, and nothing warns you because your provider thinks it's working.
Your email's digital seal is still marked as a test: Receivers are told they may ignore failures of your seal, which weakens the protection it gives. If your seal is working, removing the test marker is a quick change.
We couldn't find your email's digital seal where we usually look: It may be set up under a name we can't see, which is common. If it truly is missing, forwarded emails are more likely to fail checks. Your email provider can tell you which is the case.
We found no digital seal under the name you gave us: Emails sealed under this name can't be verified, so they fail this check and are more likely to land in spam. The setting may be missing, misspelled, or replaced by your provider.

Common questions

Why can a checker not find my DKIM record automatically?: DNS provides no way to list the selectors a domain uses, so any checker can only probe names it already knows about. We check the selectors published by the major providers. If yours uses a generated selector (Amazon SES does), no checker can find it without being told the name.
How do I find my DKIM selector?: Open a message you sent recently and look at its DKIM-Signature or Authentication-Results header. The s= value is your selector. Enter it above to check that specific record.