DKIM check: test your DKIM record and key
Check whether your domain publishes a valid DKIM key, how strong it is and whether the record is set up correctly – with or without a selector.
Check DKIM record
Enter the domain you send emails from. You can add the selector – or we look for the common ones.
Lookups run through the Quad9 DNS resolver (Switzerland). We keep the checked domain and an anonymised IP address for no longer than 30 days.
How DKIM works
What is DKIM?
DKIM stands for DomainKeys Identified Mail. Your mail server signs every outgoing message with a private key and adds the signature in the DKIM-Signature header. The receiver fetches the matching public key from your domain's DNS and uses it to check that the email really comes from you and was not altered on the way.
The selector
A domain can have several DKIM keys, for example one for your mailbox and one for your newsletter tool. They are told apart by the selector. The key sits as a TXT record at selector._domainkey.your-domain.co.uk. Which selector a sender uses is shown in the signature at s=. Google uses google, for example, and Microsoft 365 uses selector1 and selector2.
What the DKIM check tests
We read the record at the selector and check the version, the key type and the key itself. RSA keys below 1024 bits are no longer accepted; 2048 bits are today's standard. We also warn about revoked keys, the testing flag t=y and a restriction to SHA-1. If you do not know the selector, we try the common selectors of the big mail providers.
Common DKIM mistakes
Record under the wrong name
The key belongs at selector._domainkey.your-domain.co.uk. Many DNS panels append the domain automatically – if you type it as well, you end up with …your-domain.co.uk.your-domain.co.uk.
Key damaged when copying
Long keys are often split into several parts. If characters are missing or quotation marks and spaces slipped in, the key is invalid and every signature fails.
RSA key too short
Receivers reject keys with 512 or 768 bits, and 1024 bits are considered weak. Generate a new 2048-bit key with your mail provider under a new selector.
DKIM forgotten after switching provider
When you move your email, the new provider needs its own key. If only the old record remains, your emails are no longer signed and DMARC can fail.
Frequently asked questions
Open an email you sent from your domain and view its headers. In the DKIM-Signature header, the selector follows s= and the domain follows d=. Your mail provider also shows it in its DKIM settings.
Either DKIM is not set up, or your provider uses a selector we do not know. Enter the selector from a sent email above and we check exactly that record.
For RSA, 2048 bits are today's standard. 1024 bits are still verified but considered weak; shorter keys are rejected. Ed25519 is short and secure but not yet supported everywhere – only use it in addition to RSA.
Yes. Every service that sends on your behalf can get its own key under its own selector. But there must be only one record per selector.
DMARC checks whether SPF or DKIM passes and matches the domain in the From address. For DKIM, that is the domain after d= in the signature. DKIM survives forwarding better than SPF, which makes it especially important for DMARC. Check your DMARC record too.
Changing it about once a year is recommended – and immediately if the private key may have fallen into the wrong hands. Create the new key under a new selector, switch sending over and only remove the old record after a few days.
