DKIM record checker
Check a DKIM selector for a domain, validate the record, and read the key strength. Leave the selector blank to probe the selectors common providers use.
What this catches
Every problem below is one this tool detects and explains, with the record to publish.
DKIM key has been revoked
The record exists but its public key is empty, which explicitly revokes the selector.
DKIM key is 1024 bits
Acceptable today, but 2048 bits is the current recommendation.
DKIM key is shorter than 1024 bits
The RSA key is too short to be considered secure and some receivers reject it.
DKIM record is malformed
The record at this selector is not a valid DKIM key record.
DKIM selector is in testing mode
The t=y flag tells receivers to ignore DKIM failures for this selector.
No DKIM key found at the selectors we checked
We probed the selectors used by common providers and found no DKIM record.
No DKIM record at the requested selector
The selector you asked about does not resolve to a DKIM key.
Common questions
- Why can a checker not find my DKIM record automatically?
- DNS provides no way to list the selectors a domain uses, so any checker can only probe names it already knows about. We check the selectors published by the major providers. If yours uses a generated selector — Amazon SES does — no checker can find it without being told the name.
- How do I find my DKIM selector?
- Open a message you sent recently and look at its DKIM-Signature or Authentication-Results header. The s= value is your selector. Enter it above to check that specific record.
Related tools
- Full domain health checkCheck SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT and BIMI for any domain in one pass, with the exact records and the fix for anything that is wrong.
- SPF checkerLook up a domain's SPF record, validate its syntax, and count the DNS lookups it costs — including every nested include — against the limit of ten.
- DMARC checkerLook up and validate a domain's DMARC record, read back what its policy actually does, and see what is needed to move to enforcement.
- MX lookupList a domain's mail exchangers and priorities, confirm each resolves to a reachable address, and catch the misconfigurations that break inbound mail.