DKIM Check
Check whether a domain publishes DKIM keys. Probes 33 selectors used by common mail providers automatically, so you do not need to know the selector name in advance.
What DKIM does
DKIM lets a receiving mail server verify that a message really came from the domain in the From address and was not altered on the way. The sending server signs each message with a private key; the matching public key sits in DNS, under a name the sender picks called the selector.
Without DKIM, anyone can put your domain in the From field. With it, forgeries fail the check and land in spam or get rejected outright.
The selector problem
A DKIM record does not live at a fixed address. It sits at <selector>._domainkey.<domain>, and the selector is chosen freely by whoever configured the mail. That is why most DKIM checkers ask you for a name you usually do not know.
Leave the field empty and this tool probes 33 selectors that the common mail providers and sending services use. That covers most setups. For anything custom, read the DKIM-Signature header of a real message from the domain and take the value after s=.
Reading the result
- Key size: 1024-bit keys still work but are below current practice. 2048 is the norm.
- Empty key: a record with
p=and nothing after it is a deliberately revoked selector, not a broken one. - Several selectors: normal. A domain that sends through more than one service publishes one per service, and rotating keys leaves the old one in place for a while.
When it's useful
- Confirming DKIM is actually live after setting up a new sending service.
- Checking whether a key rotation took effect before switching the signer over.
- Working out why a domain's mail lands in spam, together with SPF and DMARC.
- Seeing which services a domain sends through, since each one leaves its own selector.