Free tool
DKIM checker
Enter a domain and DKIM selector to check that the public key is published and valid - and see how to find the selector if you do not know it.
In short
DKIM signs each message with a private key, and receivers verify the signature against a public key published as a TXT record at selector._domainkey.yourdomain.com. To check DKIM you need the selector, which is the s= value in the DKIM-Signature header of a message you sent.v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
Finding your DKIM selector
Send yourself a message through the service you want to check, open it, and view the original headers - Show original in Gmail, View source in most other clients. Find the DKIM-Signature header: s= is the selector and d= is the signing domain. Enter both above.
A domain can publish many selectors, one per sending service, so there is no way to list them all from DNS. If d= is your provider's domain rather than yours, the message is signed but not aligned for DMARC - set up DKIM with your own domain in that provider.
What makes a DKIM record valid
A key at the right name. The record must be at selector._domainkey.yourdomain.com. Many providers publish it for you behind a CNAME at that name, which resolves to the key the same way it does for a receiver.
A usable key. The p= tag carries the public key. An empty p= means the key has been revoked, and signatures made with it fail. 2048-bit RSA keys are the current recommendation; 1024-bit keys still verify but are weaker.
A record that is not broken by formatting. Long keys are split across several quoted strings in one TXT record. DNS hosts that add stray quotes, spaces or line breaks inside the key make it unreadable, which looks to receivers exactly like a forged signature.
How the three authentication records work together is explained in SPF, DKIM and DMARC explained.
Questions
How do I check my DKIM record?
Enter your domain and the DKIM selector above. The checker reads the TXT record at selector._domainkey on your domain and reports whether a valid, non-revoked public key is published.
How do I find my DKIM selector?
Open an email you sent, view the original headers, and find the DKIM-Signature header. The s= value is the selector and d= is the domain.
Why does my DKIM check fail?
The usual causes are a wrong selector, a record published at the wrong name (some DNS hosts append your domain twice), a key broken by stray quotes or spaces, or a revoked key with an empty p= tag.
Should I use a 1024-bit or 2048-bit DKIM key?
Use 2048-bit RSA where your DNS host can store it. 1024-bit keys still verify, but they are weaker and some security reviews flag them.
More free email tools
SPF record checker
Check any domain's SPF record. Flags duplicate records, too many DNS lookups and a missing or permissive all mechanism. Free, no sign-up.
DMARC checker
Check any domain's DMARC record and reporting address. See what p=none, quarantine and reject mean, and what to change next. Free, no sign-up.
MX record lookup
Look up any domain's MX records to see which servers receive its mail and in what order, alongside its SPF and DMARC. Free, no sign-up.
Email address checker
Check whether an address can receive mail before you send to it.
Send your first email in minutes
6,000 emails a month (up to 200 a day), free forever. No card needed.