Categories
DMARC Checker SPF Checker DKIM Checker SSL Checker SSL Analyzer

DKIM Checker

Check a domain's DKIM record - see whether its public key is valid, strong, and properly configured.

Selector is optional - if you know your domain's own DKIM selector, enter it for an exact check. Otherwise we'll check common provider defaults (Google, Microsoft 365, Mailchimp, and others) automatically.

Enter a domain name to begin (selector optional).

Reference

Understanding DKIM

DKIM is one of three DNS-based checks, alongside SPF and DMARC, that let a receiving mail server verify a message wasn't altered and really came from an authorized sender.

DKIM (DomainKeys Identified Mail)
A cryptographic signature attached to outgoing mail, verified against a public key published in DNS under a specific "selector" name. Proves the message wasn't altered in transit and genuinely came from a server holding the matching private key.
The selector
DKIM has no single, fixed record location - it lives at "selector._domainkey.domain", and the selector is chosen by whoever set up outbound mail. There's no way to discover it from the domain alone; leave the selector field blank and this tool checks common provider defaults automatically, or enter your own for an exact check (see your mail provider's own DKIM setup page or your DNS records).
Key type and strength
Most DKIM keys are RSA - 2048-bit or larger is the current recommended minimum; 1024-bit is now considered weak and is being phased out by major providers. Ed25519 is a newer, smaller, equally strong alternative, though not yet supported by every mail server.
Testing mode (t=y)
A flag a domain owner sets while rolling out DKIM, asking receivers to be lenient with failures. A record still in testing mode after the rollout is finished isn't providing its full intended protection.
Why this matters
DKIM proves a message wasn't tampered with and really came from an authorized server - together with SPF and DMARC, it's what lets receiving mail servers tell genuine mail from spoofed mail.

See how a domain's policy actually enforces a DKIM failure with DMARC Checker.