Free tool · DKIM record check
DKIM Record Checker
Enter a domain and, if you know it, the DKIM selector. We look up the public key, check that it’s valid and report its length. Without a selector, we try the ones major mail services use.
What a DKIM record is
DKIM (DomainKeys Identified Mail) adds a digital signature to every message you send. The sending service signs with a private key it keeps; the matching public key is published in your DNS so any receiver can check that the message really came from your domain and wasn’t changed on the way.
The public key lives at a name made of a selector, _domainkey, and your domain:
google._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…"| Tag | Meaning |
|---|---|
v=DKIM1 | Version. Optional, but if present it must come first. |
k= | Key type: rsa (the default) or ed25519. |
p= | The public key itself. An empty p= means the key has been revoked. |
t=y | Testing mode: receivers may treat signed mail as unsigned. |
h= | Hash algorithms allowed. Optional; if you set it, list sha256 — SHA-1 may no longer be used (RFC 8301). |
How to find your DKIM selector
Each sending service picks its own selector, and DNS has no way to list them, so a checker can only guess common ones. To know for sure:
- Send yourself an email from the account or service you want to check.
- Open the message’s full headers (“Show original” in Gmail, “View source” or “Message details” in other apps).
- Find the
DKIM-Signature:line.s=is the selector andd=is the signing domain. - Enter that domain and selector above.
Google Workspace uses google by default. Microsoft 365 always uses selector1 and selector2, published as CNAME records that point to keys Microsoft hosts — this checker follows the CNAME to the key.
Key length: 1024 or 2048 bits?
The DKIM standard says signers must use RSA keys of at least 1,024 bits and should use 2,048 (RFC 8301), and receivers must reject signatures from shorter keys. Gmail requires at least 1,024 bits.
Google Workspace offers 2,048-bit keys and suggests 1,024 only if your DNS host can’t store the longer record. Microsoft 365 creates 1,024-bit keys by default; administrators can switch a domain to 2,048 bits with the Rotate-DkimSigningConfig PowerShell command. This checker reports the exact length of every key it finds.
Turning DKIM on
- Google Workspace: generate the key in the Admin console, publish the TXT record at
google._domainkey, wait for it to propagate, then click Start authentication. Google notes it can take up to 48 hours to start working. - Microsoft 365: in the Defender portal, open the domain’s DKIM settings, publish the two CNAME records it shows for
selector1._domainkeyandselector2._domainkey, then turn on signing once Microsoft detects them. - Other services (newsletters, CRMs, helpdesks): look for “DKIM” or “domain authentication” in the service’s settings. Each sending service needs its own key.
Questions
Can a domain have more than one DKIM record?
Yes — one per selector. Each service that sends as your domain should sign with its own selector and key, and keys are rotated by publishing a new selector before retiring the old one.
Why does the checker say no DKIM key was found?
Either DKIM isn’t set up, or it uses a selector we didn’t try. Find the s= value in a sent message’s DKIM-Signature header and check that selector.
What does an empty p= mean?
The key has been revoked. That’s normal for an old selector after a key rotation, as long as another selector has a working key.
Does DKIM stop spoofing on its own?
No. DKIM proves which domain signed a message, but a forger can sign with their own domain. DMARC is what requires that domain to match your From address.
Is a 1024-bit DKIM key still safe?
It meets the minimum and Gmail accepts it, but the standard recommends 2,048 bits. Move to 2,048 at your next key rotation if your provider and DNS host support it.
Sources
More free tools
Check something else
Setup guides