Find DKIM public keys on common selectors and inspect key type, size and flags
What is the DKIM Checker?
The dkim checker works like this: it sweeps the common DKIM selector names at <selector>._domainkey.<domain> - ordered by the mail provider your MX records actually point to - and inspects every public key it finds: algorithm, estimated key size, revocation flag and test mode. Everything happens on your device - the input never leaves your tab unless the tool clearly states it performs a server-side lookup.
How to use the DKIM Checker
Enter the domain and press Check - the sweep covers the selectors your mail provider actually uses first.
If you know your exact selector (from an email’s DKIM-Signature header or your provider’s dashboard), type it in the optional field for a guaranteed check.
Read each key’s status: strong, acceptable, weak (under 1024 bits), revoked (empty p=) or testing (t=y).
Expand "Show full record" to copy the exact TXT value for your DNS panel.
Features
Provider-aware sweep: MX records are read first, so Google/Microsoft/Zoho/Proton/SendGrid selectors are checked with priority
30+ common selectors probed in parallel, plus your custom selector if supplied
Key health: size estimation, revocation detection (empty p=), test-mode flag
Honest negatives: "not found on common selectors" is never reported as "DKIM is not configured"
Common mistakes to avoid
Assuming DKIM is off because a checker found nothing - selector names are arbitrary and the real one may simply be uncommon
Publishing a 1024-bit (or smaller) RSA key, which is considered breakable today
Leaving an empty p= tag in place, which formally revokes the selector
Enabling DKIM in the provider dashboard but never adding the DNS record (or vice versa)
Getting a reliable answer for dkim checker without installing an app
One-off tasks done in under a minute from any device
Checking results before committing them to something important
Working on a phone where desktop software is unavailable
Privacy
The domain name (and optional selector) you type is sent to this site’s DNS lookup endpoint only to retrieve the public records. Nothing is stored beyond a short cache.
Frequently asked questions
What is a DKIM selector?
The label that identifies which key signed a message. The record lives at <selector>._domainkey.<domain>. You can see your real selector in any signed email’s DKIM-Signature header (the s= tag).
The checker found nothing - is DKIM really missing?
Not necessarily. Selector names are arbitrary, so no tool can prove a negative. Copy the s= value from a DKIM-Signature header of your own outbound mail and re-run with that selector.
How do I find my selector?
Send yourself an email from the system in question and view the raw headers: the DKIM-Signature line contains d=yourdomain and s=yourselector. Alternatively, your provider’s DKIM setup page names it.
What key size should DKIM use?
2048 bits or larger for RSA. 1024-bit keys are considered weak. If your provider only offers 1024-bit keys, ask about an upgrade or rotate to a stronger algorithm.
Related tools
DMARC Checker - Check a domain’s live DMARC policy: enforcement level, report addresses and alignment
SPF Checker - Validate SPF records with the real RFC 7208 include-chain walk and 10-lookup budget
Domain Age Checker - Look up domain age, registrar, expiry and nameservers from the official registry