How this check works
We query the TXT record at <selector>._domainkey.<domain>, following any CNAME delegation to your email provider, and parse it according to RFC 6376.
The public key is decoded and parsed. We report the key type and size against RFC 8301 (RSA keys under 1024 bits must be rejected by verifiers; 2048 bits is the recommended size) and RFC 8463 for Ed25519 keys, and we catch common publishing mistakes such as quotes or spaces pasted into the key.
Limitations
- DNS cannot list selectors, so we cannot discover them for you. Take the selector from the DKIM-Signature header (s=) of a message you sent.
- A valid key record does not prove that your mail is signed with the matching private key. Send a test message and check its Authentication-Results header.
- Checked domains and selectors are not stored or logged.
Frequently asked questions
How do I find my DKIM selector?
Open a message you sent, view its original source and find the DKIM-Signature header: the selector is the value of s=, the domain is d=. Common defaults are “google” for Google Workspace and “selector1”/“selector2” for Microsoft 365, but your provider may use its own names.
Why can’t you find my selectors automatically?
DNS has no way to list the names under _domainkey, and guessing many selectors would only find popular defaults. Tools that claim to “find all selectors” are guessing too.
Is a 1024-bit key still acceptable?
It is the minimum verifiers must accept (RFC 8301), and Gmail requires at least 1024 bits. Use 2048 bits where your DNS provider supports the longer record; some panels need the key split into several strings, which is fine.
What does “key revoked” mean?
The record has an empty p= tag. That is the standard way to retire a key: signatures made with it now fail. If you still sign with that selector, publish the new key or switch the selector in your provider’s settings.
The key is valid, but DKIM fails in my message headers. Why?
Common causes are a message modified in transit (mailing lists, footers added by gateways), a key rotated in DNS but not in the sending service, or a signature made for a different domain than you expect. The header analyzer shows the d= and s= that were actually used.