Free DKIM check
Find the DKIM keys a domain publishes under common and provider selectors, with each key's type, size and what to fix. Free, no signup.
Reads public DNS only: nothing is changed and no email is sent.
What the check reads
A public key for every service that signs your mail.
- Selectors
- Each sending service publishes its key at selector._domainkey.yourdomain. The check tries the selectors common services use and the ones your SPF and MX records point to.
- Key type and size
- RSA keys of 2048 bits are the recommendation; 1024-bit keys still pass but are weaker. Ed25519 keys are short by design.
- Revoked keys
- A record with an empty p= revokes a key: mail signed with it fails DKIM.
Questions, answered
Before you change the record.
What is a DKIM selector?
A name that says where a sending service publishes its key: selector._domainkey.yourdomain. Each service picks its own, such as google for Google Workspace or selector1 and selector2 for Microsoft 365.
Why was no key found?
The check tries the selectors common services use and the ones your SPF and MX records point to. A service that uses its own selector name will not be found this way: the selector is in the DKIM-Signature header (s=) of an email it sent.
Is a 1024-bit key enough?
Gmail and Yahoo accept keys of at least 1024 bits, but 2048 bits is the current recommendation. Most services let you switch to a 2048-bit key in their admin settings.
How do I fix a missing or weak key?
In the admin settings of the service that sends the email: it creates the key pair and tells you which selector record to publish. The private key never leaves that service.
Related tools