EN LV RU

DKIM record check

Enter a domain and a selector to see the DKIM public key, its length and any errors in the record.

Why the selector has to be given

A DKIM key is published at selector._domainkey.example.com. The selector is chosen by whoever sends the mail, and DNS offers no way to list the names under a domain, so it cannot be discovered automatically. It is written in every message that sender signs: open the full headers, find the DKIM-Signature line and read the value after s=.

Google Workspace usually signs with google, Microsoft 365 with selector1 and selector2, but any provider is free to use something else, and a domain that sends through several services has several selectors at once.

What the result means

An empty p= value is a revoked key. The record still exists, but the selector is no longer usable and signatures made with it will not verify.

The flag t=y means test mode: receivers are asked not to treat a failed signature as a failure. It is useful while DKIM is being rolled out and should be removed once signatures verify, otherwise the key stays advisory for good.

Frequently asked questions

Where do I find my DKIM selector?

Send a message to a mailbox you can open, show the full headers and look at the DKIM-Signature line. The value after s= is the selector, and the value after d= is the domain the key is published under.

How long should the key be?

2048 bits for RSA. 1024 bit keys still verify but are no longer considered strong enough. Some DNS panels refuse a value that long on one line, in which case the record is entered as several quoted strings that the server joins back together.

Can one domain have several DKIM selectors?

Yes, and that is the normal situation. Every mail service publishes its own selector and they do not interfere with each other. Key rotation works the same way: the new selector is published before the old one is withdrawn.

The record is published, so why do signatures still fail?

The usual reasons are a published key that no longer matches the private key in use after a rotation, a value pasted with line breaks or stray spaces inside it, and a mailing list or gateway that modifies the message after it was signed.

Related tools

DKIM key generator

A 2048 bit key pair made in your browser, with the record to publish.

SPF record check

Syntax, the include chain and the ten DNS lookup limit.

DMARC record check

Policy, rua and ruf addresses, alignment and errors.

TXT record lookup

TXT records named one by one: SPF, DKIM, DMARC and ownership tokens.