What is a DKIM record?
A DKIM record is a DNS TXT record that publishes a public key at selector._domainkey.yourdomain.com. The sending server signs each message with the matching private key, and receivers fetch the public key to confirm the message really came from that domain and was not changed on the way.
Why you need a selector
A domain can publish many DKIM keys at once — one per sending service — and each lives under its own name, the selector. DNS offers no way to list them. The only place a selector is announced is inside a signed message, in the s= tag of the DKIM-Signature header.
So this tool does two things. It checks any selector you type, and it also tries the default selectors of the large providers, such as google, selector1, selector2, s1, k1 and default. If it finds nothing, that does not prove DKIM is missing. It means the key is under a selector the tool did not guess.
How to find your DKIM selector
- Send an email from the system you want to check to an address you can read.
- Open the message and view its raw source — "Show original" in Gmail, "View message source" in Outlook.
- Find the
DKIM-Signatureheader whosed=value is your domain. - The
s=value in that header is the selector. Enter it above.
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=google; ...| Provider | Usual selectors |
|---|---|
| Google Workspace | google |
| Microsoft 365 | selector1, selector2 |
| Mailchimp | k1, k2, k3 |
| SendGrid | s1, s2 |
| Fastmail | fm1, fm2, fm3 |
How to read the results
| Check | Pass | Problem |
|---|---|---|
| Key found | A TXT record with a p= tag exists at the selector | Nothing at any tried selector — inconclusive, enter your own |
| Key size | RSA 2048 bits or more, or Ed25519 | 1024 bits is weak; under 1024 is rejected by receivers |
| Key readable | The p= value decodes to a valid public key | Truncated or badly split — usually a copy-paste error |
| Not revoked | p= contains a key | An empty p= means the key was deliberately revoked |
| Not in test mode | No t=y flag | t=y tells receivers to ignore failures |
Key sizes come from RFC 8301: signers must use at least 1024 bits and should use 2048, and receivers must not accept anything smaller than 1024.
How to fix common DKIM problems
The key is 1024 bits. Generate a new 2048-bit key in your mail provider's admin console, publish it under a new selector, switch signing to it, and remove the old record a week later once mail signed with the old key has been delivered.
The key will not decode. A 2048-bit key is longer than the 255 characters one DNS string can hold, so it has to be split into several quoted strings in a single TXT record. Some DNS control panels do this for you and others need it done by hand:
google._domainkey TXT ( "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..." "...rest of the key...IDAQAB" )The record is a CNAME. That is normal for Microsoft 365 and many email services: the CNAME points at a key they host and rotate. This checker follows it.
t=y is still set. Remove the flag once you have confirmed signatures verify. While it is there, DKIM adds no protection.