← All tools
DKIM Record Checker
Enter a domain and, if you know it, the DKIM selector. We look up the public key and check its size and state. Leave the selector empty and we'll try the 34 selectors providers use by default.
What this does - and doesn’t - tell you
What’s checked
- Whether a DKIM public key is published at the selector you give
- Key size (1024-bit keys are on the way out; 2048 is the standard)
- Revoked keys (empty p=) and testing mode (t=y) that makes receivers lenient
- Without a selector: a scan of the 34 selectors Google, Microsoft, Zoho, Proton, Mailchimp and others use
Worth knowing
- The selector is the s= value in a message's DKIM-Signature header. If you don't know it, send yourself an email and read it in the Email Header Analyzer.
- A key that exists isn't proof your mail is signed with it - the header of a real message is. This checks the DNS side.
- A key can sit on a selector we didn't try; a scan that finds nothing doesn't mean DKIM isn't set up.
Unsigned or misaligned mail is one of the most common reasons good campaigns land in spam. We set up and verify DKIM for every sending domain.
How we help: Consulting · Private infrastructure · Managed mailboxes · Monthly support