Free DKIM checker
DKIM signs messages with a key published in DNS. This checker discovers a domain's selectors, reads the public keys and flags weak, revoked or test-mode keys.
DKIM selectors and keys
A DKIM key is published at “selector._domainkey.domain”: each sending service has its own (Google “google”, Microsoft “selector1”/“selector2”, etc.). The signature is only as strong as the key — a 1024-bit RSA key is below the state of the art, anything smaller is breakable, and an empty “p=” marks a revoked key.
How the checker works
The checker queries public DNS for a list of common selectors, then reads each key it finds (type, size) and spots revoked or test-mode keys. It reads only public DNS data — no server on the domain is contacted. If the domain's selector isn't in the list, entering it is enough.
Why it matters
Without valid DKIM, DMARC alignment rests on SPF alone — more fragile on forwarding. A weak or revoked key undermines the signature and receiver trust. Publishing a 2048-bit RSA key (or Ed25519) and removing dead keys restores a healthy authentication baseline.
Frequently asked questions
- Does the analysis pose any risk to the domain?
- No. The checker reads only public DNS records; it connects to no server on the domain and changes nothing.
- What if no selector is found?
- The domain may use a selector outside the common list. The selector appears in the sender's console or in the “DKIM-Signature” header of a received message; entering it is enough to analyze it.
- What DKIM key size should be used?
- RSA 2048-bit is the state of the art (M3AAWG); 1024-bit is tolerated but weak; below that the key is breakable. Ed25519 is safe with a short key.