Published keys
We try your selector first, then 14 common ones, and show every key we find with the provider that usually uses it.
Free tool
DKIM checker
Check the keys that sign your email. Enter a selector if you know it, or leave it blank and we will try the ones Microsoft 365, Google Workspace and common senders use.
Nothing is stored. Works with any domain, not just ours.
What it checks
What we look for
A DKIM key is a TXT record at selector._domainkey.yourdomain. Receivers use it to check the signature on your mail.
Key strength
We estimate whether each RSA key is 1024 or 2048-bit, and flag 1024-bit keys as worth replacing.
Revoked and wildcard keys
An empty key means it has been revoked. An empty wildcard record answering every selector means the domain is saying it does not sign mail.
How DKIM works
DKIM (DomainKeys Identified Mail) adds a digital signature to every message you send. Your email provider signs with a private key; the matching public key sits in your DNS. A receiver looks up the key, checks the signature, and knows the message really came from a server you authorised and was not changed on the way.
Unlike SPF, a DKIM signature survives forwarding, which makes it the more reliable of the two for passing DMARC.
Every service that sends as you needs its own key
Your mailboxes are only one sender. Newsletter platforms, CRMs, accounts software and helpdesks all send email with your address on it, and each needs DKIM set up on your domain — usually by publishing a record or CNAME they give you. Each gets its own selector, so a domain often has several keys. Your DMARC reports show which services are sending without a valid signature.
Common results
- Key found, 2048-bit: good. Check every other service that sends as you has a key too.
- Key found, 1024-bit: still works, but rotate to 2048-bit when your provider allows.
- Not found on your selector: check the spelling against your provider’s settings, and allow time for DNS to update after publishing.
- Not found on any common selector: DKIM may still be working under a selector we do not know. Find it in a sent message’s headers (s=) and enter it above.
Our guide to SPF, DKIM and DMARC explains how the three records fit together.
Questions
About DKIM
What is a DKIM selector, and how do I find mine?
The selector is the name your DKIM key is published under, at selector._domainkey.yourdomain. To find it, open any email you have sent, view the message source or headers, and look in the DKIM-Signature header for s= (the selector) and d= (the signing domain).
Which selectors does the checker try automatically?
selector1 and selector2 (Microsoft 365), google (Google Workspace), k1 and k2 (Mailchimp), s1 and s2 (SendGrid), fm1 (Fastmail), zoho, protonmail, and the common defaults default, dkim, mail and mxvault. Enter your own to check any other.
Why does it say no DKIM key was found when our mail is signed?
DNS cannot list every selector on a domain, so we can only check names we know or that you give us. If your provider uses a selector not on our list, enter it in the selector box.
Should my DKIM key be 1024 or 2048-bit?
2048-bit RSA is the current recommendation. The checker estimates key size from the length of the published key, so treat it as a guide. Some DNS hosts need a long key split into more than one string, which most handle automatically.
If DKIM passes, does DMARC pass too?
Only if the signing domain (d=) matches the domain in the From address. A mailing service that signs with its own domain passes DKIM but not DMARC for yours, which is why such services ask you to publish a key on your own domain.
Related tools and guides
Rather have it done for you?
SPF, DKIM and DMARC are set up and monitored for every MyExchangeServer customer. Or send us your results for a second opinion from an engineer.
- Free assisted migration
- No set-up fee, no minimum term
- UK data centres, UK engineers