DKIM checker
Check a DKIM public key by domain and selector, or scan the selectors used by Google Workspace, Microsoft 365 and popular email services. Shows key type, length and revoked keys.
Leave the selector empty to try the common ones.
How DKIM signing works
The sending server hashes selected headers and the body, signs the hash with a private key, and adds a DKIM-Signature header naming the domain (d=) and selector (s=). The receiver fetches the public key from DNS at s._domainkey.d and verifies. If anything signed was altered in transit, verification fails. DMARC then checks that d= aligns with the From: domain; see the DMARC checker.
Questions people ask
What is a DKIM selector?
A label that lets a domain publish several DKIM keys at once, at
selector._domainkey.domain. The sending server names the selector in each message's DKIM-Signature header as s=. Look there in a received message's headers to find it.What are common DKIM selectors?
Google Workspace uses
google; Microsoft 365 uses selector1 and selector2; Mailchimp k1; SendGrid s1/s2; Amazon SES uses long random selectors. The "try common selectors" button checks the usual ones.What key length should DKIM use?
2048-bit RSA is the current recommendation; 1024-bit is still accepted but considered weak. Ed25519 keys (RFC 8463) are short and strong, but not every receiver verifies them yet, so publish them alongside an RSA key.
What does an empty p= mean?
The key has been revoked. Mail signed with that selector will fail DKIM.