DKIM record checker

Check the DKIM keys of a domain: type the selector you use, or let the checker try the common ones, and see each key’s type and size, whether it is revoked, and what is wrong with the record.

The DNS lookups go straight from your browser to public resolvers (Cloudflare, Google): we see nothing.

What the DKIM checker verifies

The selector you give: DKIM keys are published at <selector>._domainkey.<domain>. Give the selector found in the s= of a DKIM-Signature header and the checker reads that exact record, or tells you it does not exist.
The common selectors: About thirty selectors used by Google Workspace, Microsoft 365, Mailchimp, Proton, Zendesk, OVHcloud and others are tried as well. Selectors cannot be listed, so finding none here does not prove there is none.
Key type and size: RSA keys under 1024 bits are refused by most receivers and 2048 bits is today’s norm. Ed25519 keys are short by design (256 bits) and strong.
Revoked keys: An empty p= means the key was withdrawn on purpose: every message still signed with it fails DKIM.
The syntax of the record: v= must be DKIM1 when present, k= rsa or ed25519, and p= the base64 of a real key. A record that only allows SHA-1 (h=sha1) is no longer accepted, and t=y marks a key in test mode.

How to read the result

Green: a valid key: The selector publishes an RSA key of 2048 bits or more, or an Ed25519 key. Messages signed with it can pass DKIM.
Amber: weak or uncertain: A 1024-bit key, SHA-1 only, test mode, or no key on the common selectors. Give your own selector to be sure.
Red: broken: The selector you gave has no record, or its key cannot be read: every message signed with it fails DKIM.
The table of keys: Each selector found, its key type, size and status. Open a selector to see its full record, as receivers get it.

Common DKIM errors and how to fix them

DKIM failures show up in the Authentication-Results header of a received message and in mail server logs. These are the usual ones, what they mean and what to change.

`No DKIM record found for selector`

Why. The signature names a selector that has no record in the DNS. Receivers write it as dkim=neutral (no key for signature) or dkim=permerror (no key for signature). The provider’s records were never added, were added to the wrong zone, or the provider moved to a new selector.

Fix. Copy the records from the provider’s console (often two CNAME records, such as selector1 and selector2 for Microsoft 365), check them here with that selector, then turn signing on.

`DKIM signature failed`

Why. The key was found, but the signature does not verify: dkim=fail (signature did not verify), or dkim=neutral (body hash did not verify) when the message was changed after signing, by a mailing list footer or a security gateway, for example. It also happens when the published key no longer matches the private key.

Fix. If all your mail fails, publish the key again from the provider: a record cut when it was pasted is common. If only forwarded or list mail fails, that is expected; DMARC can still pass through SPF on direct mail.

`dkim=pass but dmarc=fail`

Why. The message is signed, but by the provider’s domain (d=sendgrid.net, d=mailchimpapp.net) rather than yours. DKIM passes, but it is not aligned with the From address, so DMARC fails.

Fix. Set up domain authentication (sometimes called custom or branded domain) with the provider, so that it signs with d=your domain.

`DKIM key too short`

Why. The key has 1024 bits or fewer. Keys under 1024 bits are refused; 1024 bits is accepted but below current recommendations.

Fix. Generate a 2048-bit key with your provider, publish it under a new selector, switch signing to it, then revoke the old key by emptying its p=.

`DKIM public key invalid`

Why. The p= value is not valid base64 or not a whole key: quotes or spaces inside it, a line break, or a long value cut at 255 characters.

Fix. Paste the key in one piece. A TXT value over 255 characters must be split into several quoted strings, never cut; most DNS panels split it themselves.

Questions

How do I find my DKIM selector?

Open a message you sent, show its original or its headers, and find DKIM-Signature: the selector is the value of s=, the signing domain the value of d=. Our e-mail header analyzer reads them for you.

Why does the checker not find my DKIM key?

Each provider chooses its selectors and they cannot be listed. If yours is not one of the common ones, the checker cannot guess it: type it in the selector field.

Should DKIM keys be 1024 or 2048 bits?

2048. 1024-bit keys still pass at most receivers but are below current recommendations, and anything shorter is refused. If your DNS provider struggles with long records, use Ed25519 alongside an RSA key.

How do I rotate a DKIM key?

Publish the new key under a new selector, switch the provider to sign with it, wait a few days for messages in transit, then revoke the old key by publishing it with an empty p=.

Is anything sent to your servers?

No. The lookups go from your browser to public DNS-over-HTTPS resolvers (Cloudflare, then Google); we see nothing.