Free DKIM checker
Strong signatures, keys kept up to date.
DKIM signs messages with a key published in DNS. This checker discovers a domain's selectors, reads the public keys and flags weak, revoked or test-mode keys.
- Free
- No account
- Instant result
- Public data only
Analyze a domain
How it works
- 1
Enter a domain
Enter the domain to analyze — and its selector if you know it. No account required.
- 2
Public DNS is read
The checker probes the most common selectors, reads each published key and spots weak, revoked or test-mode keys.
- 3
Instant verdict
The selectors found and each key’s type and size appear on screen. A free account then lets you monitor changes over time.
Why it matters
Without valid DKIM, DMARC alignment rests on SPF alone — more fragile on forwarding. A weak or revoked key undermines the signature and receiver trust. Publishing a 2048-bit RSA key (or Ed25519) and removing dead keys restores a healthy authentication baseline.
Forgeable signature
A 1024-bit RSA key is below the state of the art; anything smaller is breakable and the signature proves nothing.
Dead keys in DNS
A revoked key (empty “p=”) left in place muddies validation and betrays an unfinished rotation.
DMARC weakened
Without valid DKIM, DMARC alignment rests on SPF alone — more fragile, especially on forwarding.
DKIM selectors and keys
A DKIM key is published at “selector._domainkey.domain”: each sending service has its own (Google “google”, Microsoft “selector1”/“selector2”, etc.). The signature is only as strong as the key — a 1024-bit RSA key is below the state of the art, anything smaller is breakable, and an empty “p=” marks a revoked key.
Worth remembering — Aim for RSA 2048-bit or Ed25519; 1024-bit is tolerated but weak. Each sending service publishes its own selector.
How the checker works
The checker queries public DNS for a list of common selectors, then reads each key it finds (type, size) and spots revoked or test-mode keys. It reads only public DNS data — no server on the domain is contacted. If the domain's selector isn't in the list, entering it is enough.
Frequently asked questions
- Does the analysis pose any risk to the domain?
- No. The checker reads only public DNS records; it connects to no server on the domain and changes nothing.
- What if no selector is found?
- The domain may use a selector outside the common list. The selector appears in the sender's console or in the “DKIM-Signature” header of a received message; entering it is enough to analyze it.
- What DKIM key size should be used?
- RSA 2048-bit is the state of the art (M3AAWG); 1024-bit is tolerated but weak; below that the key is breakable. Ed25519 is safe with a short key.