Free tool
DKIM checker
Enter a domain to find its DKIM keys. No selector needed: we try the common ones, and you can paste a header from an email you sent.
Sending outreach from this domain? GEOboom finds the pages AI answers cite and runs the outreach to get you mentioned on them, with the mailboxes included.
See how it worksHow DKIM works
Signed when sent
Each service that sends your mail signs every message with a private key and adds a DKIM-Signature header naming the domain (d=) and selector (s=).
Checked on arrival
The receiver fetches the public key from selector._domainkey.domain and verifies the signature. A changed message or a missing key fails.
Counted by DMARC
DMARC passes when DKIM passes for your own domain. Unlike SPF, a DKIM signature survives forwarding, which makes it the one to rely on.
Questions
What is a DKIM selector, and how do I find mine?
A selector is the name a sending service publishes its DKIM key under, at selector._domainkey.yourdomain.com. Each service usually has its own. DNS can't list them, so the reliable way to find yours is an email you sent: open its headers, find DKIM-Signature, and read s= (the selector) and d= (the domain it was signed for). Paste that header above and we check exactly that key.
The checker found no key. Does that mean DKIM isn't set up?
Not necessarily. Without a selector, any checker can only try likely names; we try your mailbox provider's and 36 common ones. Amazon SES, Postmark, HubSpot and many custom setups use selectors no list will guess. Paste a DKIM-Signature header from a real email to be sure.
What does an empty key (p=) mean?
The key has been retired on purpose: the owner left the selector in DNS with no key, so anything signed with it stops verifying. That's normal after rotating keys. Some domains answer every selector with an empty key, which says the domain sends no signed mail at all. We report both as retired, not as keys.
Is a 1024-bit key a problem?
It still works, and receivers accept it. 2048 bits is the current recommendation, and most providers now generate 2048-bit keys by default. If your provider lets you rotate to a 2048-bit key, do it; there is nothing to gain by staying on 1024.
My email passes DKIM but fails DMARC. Why?
DMARC needs DKIM to pass for your own domain. Many services sign with their own domain by default, such as sendgrid.net, so DKIM passes for them and not for you. The d= in the DKIM-Signature header shows which domain signed. Set up DKIM with your domain in that service, which usually means adding the CNAME records it gives you.
How do you find DKIM keys without knowing the selector?
DNS can't list the names under a domain, so any checker has to try names. We start with the selectors of your mailbox provider, worked out from your MX records, then try about 35 defaults used by the large email services. Before that, we ask for a random selector: a domain that answers that one answers every name, and its "keys" are a wildcard, not keys. Where a selector is a CNAME into a provider's DNS, such as sendgrid.net, the provider is certain; otherwise we name the likely service from the selector and say it's a guess.
What's in a DKIM record?
A TXT record at selector._domainkey.yourdomain.com with a few tags. v=DKIM1 marks it as a DKIM key. k= is the key type, RSA unless it says ed25519. p= is the public key itself, in base64; an empty p= means the key has been retired. t=y marks a key still in testing, which some receivers treat more leniently. We read the key's size from p=, since that's what decides whether it's strong enough.