Sign up free

DKIM Checker – Look Up and Test DKIM Records

Enter a domain, add the selector if you know it, and see each DKIM public key with its type and length.

About DKIM Checker

Run the DKIM checker after you turn on signing in Google Workspace, Microsoft 365 or a newsletter service, when DMARC reports show DKIM failing, or before you rotate a key. DKIM keys live at selector._domainkey.yourdomain, and DNS can't list them, so the selector matters. Type it under Selector (optional), or leave it empty and the tool tries about 45 common ones, such as google, selector1, selector2, k1, s1, default and Google's date-based selectors like 20230601.

For every key found you see the algorithm, RSA or Ed25519, and its length. Keys under 2048 bits get a warning and keys under 1024 bits fail, because many receivers reject them. Revoked keys with an empty p=, keys that can't be read and keys in test mode (t=y) are flagged too. The checker reads the published keys, not a signed message. To see which domain and selector actually signed an email, paste its headers into the Email Header Analyzer.

How to use DKIM Checker

  1. 1
    Enter the domain

    Type the domain you send from, or paste an email address.

  2. 2
    Add the selector if you know it

    Find it as s= in the DKIM-Signature header of a message you sent, or leave the box empty.

  3. 3
    Run the DKIM checker

    Click Check, and without a selector about 45 common names are tried at once.

  4. 4
    Read each key

    The table shows selector, algorithm, bits and state, and you can copy it or save it as CSV.

Why use Cubfile for this

  • Selector auto-detect

    About 45 common selectors are tried when you don't enter one.

  • Key length check

    A warning under 2048 bits and a fail under 1024.

  • RSA and Ed25519

    The algorithm and size are read from the public key itself.

  • State of each key

    Revoked, unreadable and test-mode keys are flagged.

FAQ

DKIM Checker: questions and answers

How do I find my DKIM selector?
Open an email you sent, view its original headers and look for s= in the DKIM-Signature line, next to d=, the signing domain. Google Workspace uses google by default, and Microsoft 365 uses selector1 and selector2.
Why does the DKIM checker find no key?
Your service may use a selector outside the common list, signing may not be switched on yet, or the TXT or CNAME record sits at the wrong name. Enter the exact selector and make sure the record is at selector._domainkey.yourdomain. A DNS Lookup on that exact name shows whether the TXT or CNAME record is published.
Is a 1024-bit DKIM key still OK?
It still works, so it gets a warning rather than a fail, but 1024-bit keys are being retired. Create a 2048-bit key when your provider allows it.
What does t=y mean in a DKIM record?
The key is in test mode, and receivers may ignore its results. Remove t=y once signing works.
Is the DKIM checker free?
Yes, with no sign-up, and it doesn't use your daily tasks. An hourly allowance applies, higher for signed-in members, and results aren't stored.
Share DKIM Checker with a friendIt runs in any browser, and they can try it without signing up.

Related tools

MAIL MX Record LookupSee which mail servers receive email for a domain, in priority order.
MAIL DMARC CheckerRead a domain’s DMARC policy and where its reports go.
MAIL Email Header AnalyzerPaste email headers to see the servers a message passed, delays and SPF/DKIM results.
MAIL Email Address CheckerCheck email addresses for typos, disposable domains and working mail servers.
MAIL SPF Record CheckerCheck an SPF record, expand its includes and count DNS lookups.
MAIL DMARC Record GeneratorCreate a DMARC record step by step, from monitoring to reject.
MAIL SPF Record GeneratorBuild a correct SPF record for your mail providers.
SEO Broken Link CheckerCheck every link on a page and list the ones that are broken or redirected.