DKIM check

Check the DKIM record of a domain and its key length

DKIM signs every message with a key, and receivers check the signature against the public key in DNS. The key sits at selector._domainkey.domain.

A message with a DKIM signature and the key that verifies it

How DKIM keys work

The selector lets a domain keep several keys at once: one per mail service, or an old and a new key during rotation. Google Workspace uses google, Microsoft 365 uses selector1 and selector2, and Mailchimp uses k1.

Keys shorter than 2048 bits are easier to break, and some receivers already treat 1024-bit signatures as weak. Rotate keys once or twice a year.

When you need it

Check that a new mail service signs with your domain
Find weak 1024-bit keys before a campaign
Confirm that a key rotation reached DNS

Questions and answers

01How do I find my DKIM selector?

Open a message you sent and find the DKIM-Signature header: the selector is the s= tag. Mail providers also show it in the domain settings.

02Why is the key not found?

The selector may be wrong, the provider may ask for a CNAME you have not created yet, or DNS has not updated since the change.

03Which key length should I use?

RSA with 2048 bits. Fewer receivers support Ed25519, so publish it next to an RSA key if you use it.

04Can a domain hold several DKIM keys?

Yes. Each service gets its own selector: one for Google Workspace, another for the mailing service. The keys live on different names and do not interfere.

05How often should I rotate the DKIM key?

Every 6 to 12 months. Publish a key under a new selector, switch signing to it, and delete the old one a few days later, once letters with the old signature have arrived.