Log in
Checker

DKIM key checker

Look up a domain's DKIM keys and check the key length – with a selector or an automatic search for common selectors.

What the DKIM checker checks

With DKIM, the sending server signs every email. The receiver finds the matching public key in DNS at <selector>._domainkey.<domain>. The checker reads this record and checks:

  • whether a valid key is published (an empty p= means the key is revoked),
  • the key length: 2048 bits is the standard, 1024 bits is considered weak, anything below insecure,
  • without a selector, the common names such as default, google, selector1 or s1.

Whether an email is actually signed correctly can only be seen on a real email – that's what the email test checks.

FAQ

How do I find my DKIM selector?

Open the header of a sent email and look for the DKIM-Signature line. The value after s= is the selector, after d= the signing domain. Without a selector we try the common names automatically.

Which DKIM key length is right?

Use 2048 bits. 1024-bit keys are considered weak, and many providers reject shorter ones.

Why is my DKIM signature invalid?

Usually the public key in DNS doesn't match the server, for example after switching sending services, or the email was changed after signing, for example by a footer or forwarding.