DKIM checker
Look up the DKIM key published on a domain's selector, and see its type and size.
What this checks
Four things we read off the selector.
The selector's record
We read the TXT record on your selector plus _domainkey plus your domain, which is where a DKIM key lives.
The key itself
The type and the size are read from the key material itself, so a broken key shows up as broken.
The common selectors
Leave the selector empty and google, selector1, selector2, k1, default, s1, s2, mail, dkim, zoho and mxvault are all tried at once.
Test and revoked keys
t=y marks a key as a test, which tells receivers to ignore a failure. An empty p= revokes the key outright. Both are easy to leave behind by accident.
How to fix it
Find the selector, publish the key, test it.
DKIM is one TXT record per sending service. The hard part is usually finding which selector a provider gave you.
- 01
Find your selector
Open a message you sent, from the receiving side, and show the full headers. The DKIM-Signature line has an s= part, and that is the selector. Gmail calls it Show original, Outlook calls it View message source.
DKIM-Signature: v=1; a=rsa-sha256; d=yourdomain.com; s=selector1; ...
- 02
Get the key from your mail provider
Every provider has a page for this, usually called DKIM or email authentication. It hands you a host and a long value, or offers to generate the key for you. Ask for 2048 bits if you get the choice.
- 03
Publish it as a TXT record
The host is your selector, then ._domainkey, then your domain. The value is the line the provider gave you, pasted whole. Most panels take the long value fine, and a few split it for you.
selector1._domainkey.yourdomain.com TXT v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0...
- 04
Send a test and read the headers
Send to an address at another provider, open the full headers, and look for dkim=pass with your domain on it. Then come back here and check the key the way a receiving server sees it.
Questions
The things people ask next.
What is DKIM?+
DKIM puts a signature on every message you send, made with a private key your mail provider holds. The matching public key sits in your DNS, so a receiving server can check that the message really came from your domain and that nothing in it changed on the way.
What is a selector?+
A short name that points at one key. It sits in front of ._domainkey in the DNS record and in the s= part of the signature. Selectors are what let one domain hold several keys at once, one for each service that sends for you.
What key size should I use?+
2048 bits is what new setups use, and 1024-bit keys still work everywhere. Below 1024 bits many receivers treat the message as if it were never signed. Some providers also offer ed25519, which is short and strong, and a few older servers cannot read it.
Can one domain have more than one key?+
Yes, and most domains do. Each service that sends for you gets its own selector and its own key, so your mailbox provider, your newsletter tool and your invoicing app can all sign as the same domain without sharing a private key.
The same work, every client
Your AI can run this and 800+ more checksfor every client.
The email deliverability audit runs this check and the rest of them on every domain you work with, then writes the fix list your client can hand to their IT person.