Verify your domain's DKIM signature
Check whether DKIM is correctly configured for your domain. We probe common selectors and confirm your cryptographic signature is in place.
What is DKIM?DKIM (DomainKeys Identified Mail) adds a digital signature to each email. The sending service signs with a private key, and receivers fetch the public key from DNS at selector._domainkey.yourdomain to verify it. A valid signature shows the message came from your domain and was not changed.
This checker looks for DKIM keys at 15 common selectors (default, google, mail, dkim, smtp, k1, k2, s1, s2, selector1, selector2, mailjet, sendgrid, ses, mx). If your provider uses a different selector, enter it in the selector box on the report.
How to read the result
- Pass: at least one public key was found. The report lists the selectors and the key size.
- Key size: 2048-bit keys are recommended. 1024-bit keys still work but are weaker. Keys under 1024 bits fail at many receivers.
- Not found: no key at the common selectors. That can mean DKIM is not set up, or that your provider uses a selector the check does not try. Look at the DKIM-Signature header of a sent email: s= is the selector and d= is the signing domain.
- A revoked key (p= with no value) does not count as DKIM found.
Where to find your selector
Google Workspace uses google by default. Microsoft 365 uses selector1 and selector2. Many email platforms use their own names, such as k1, k2 or k3, or a random string as Amazon SES does. The selector is always shown as s= in the DKIM-Signature header of a message you sent.
Example
A DKIM public key record (shortened)
google._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...IDAQAB"
The record name holds the selector. The p= value is the public key from your email provider. Never publish the private key.
Common problems and fixes
DKIM record not found
No key in DNS for the selector in use.
DKIM signature verification failed
A key exists but the signature does not match.
DKIM neutral
The receiver could not evaluate the signature.
Gmail 550 5.7.30
Gmail blocked a message because DKIM did not pass.
Generate a DKIM key pair
For your own mail server.
Frequently asked questions
What is a DKIM selector?
A name that tells receivers where to find the public key: selector._domainkey.yourdomain. One domain can have many selectors, one for each sending service.
Why does the checker say DKIM not found when my mail is signed?
Your provider probably uses a selector outside the 15 common ones. Find s= in the DKIM-Signature header of a sent message and enter it in the selector box on the report.
Should I use a 1024-bit or 2048-bit key?
2048-bit. Google Workspace and Microsoft 365 support it. Some DNS hosts need the long TXT value split into several quoted strings.
Do I need DKIM if I have SPF?
Yes. Gmail and Yahoo expect bulk senders to have both. DKIM also survives forwarding, where SPF breaks.
How often should I rotate DKIM keys?
Many teams rotate every 6 to 12 months. Publish the new selector first, switch signing, then remove the old key after a few days.