Free tool
DKIM checker
Enter a domain and a selector to fetch the DKIM public key and check its format and length. Leave the selector empty to try common ones. No account needed. The domain is looked up in public DNS and is not stored.
DKIM checker
How to read the result
What this checker can and cannot see
DKIM is a signature on each message, verified with a public key in DNS. This tool checks the key. Only a real message can show the signature.
The key
Whether the record decodes to a real public key, its type and its length in bits.
Its state
A revoked key (empty p=), and the testing flag that tells receivers not to rely on the signature.
Where it points
The CNAME target when a provider hosts the key for you, which is how you tell whose key it is.
To test the signature on a message, paste its headers into the email header analyzer, which also shows whether the signing domain aligns with From. Then check the DMARC policy that depends on it.
FAQ
Questions about DKIM
How do I find my DKIM selector?
Open a message you sent and read its DKIM-Signature header: s= is the selector and d= is the domain. The key is published at selector._domainkey.domain. The header analyzer will read these for you from pasted headers.
Can DKIM be checked without a selector?
Only by guessing. DNS has no way to list the selectors of a domain, so this tool tries common names. Many providers use random per-domain selectors, so finding nothing does not mean DKIM is missing.
How long should a DKIM key be?
2048 bits for RSA. 1024-bit keys still verify, but are the minimum, and receivers ignore anything shorter. Ed25519 keys are valid too, though not every receiver verifies them, so they are normally published beside an RSA key.
What does an empty p= mean?
The key was revoked. Any message signed with that selector now fails DKIM, so make sure your sender has moved to a new selector before you leave a record like that in place.
Why does DKIM fail when the key looks right?
The key checks out in DNS but the signature did not verify, which usually means something changed the message after it was signed: a mailing list, a footer, or a security gateway. Compare the result in the message's Authentication-Results header with the signing domain.
Free tools
Related tools
SPF checker
Look up a domain's SPF record, follow every include, and count the DNS lookups against the limit of ten that receivers enforce.
Open the toolDMARC checker
Look up a domain's DMARC record, see which policy really applies to it, and get the record to publish next.
Open the toolEmail header analyzer
Paste a message's headers to read its SPF, DKIM and DMARC results, whether the signature aligns with the From domain, the delivery path and how it threads.
Open the tool
Next step
DKIM with no keys to generate or store
Publish the records SendRaven gives you and every message is signed with 2048-bit keys.