Free tool
DKIM checker
Enter a domain and a DKIM selector, or try the common selectors, to look up the DKIM record live and see its key type, key length, testing flag and any problem with the fix.
Looked up live
- Common selectors
- 47 tried in one click
- Key length
- 2048 bits recommended
Lookups go from your browser to Cloudflare's public DNS over HTTPS. Nothing is stored.
Lookups run from your browser to Cloudflare's public DNS over HTTPS, and nothing is stored.
How it works
One selector or dozens, read in seconds
Check DKIM after you turn on signing, after a key rotation and on every new sending domain.
- 01
Find the record
Your browser asks Cloudflare's public DNS for the TXT record at selector._domainkey.yourdomain, for your selector or for each common one.
- 02
Read the key
The tags v, k, p, t, h and s are parsed, and the public key in p= is decoded to measure its real length in bits.
- 03
Pass, warning or fail
An empty or broken key fails, keys under 1024 bits fail, 1024 bits and testing mode are warnings, each with the fix.
Related tools and guides
FAQ
Questions, answered
Short answers about the dkim checker.
What is a DKIM selector?
DKIM keys are published at selector._domainkey.yourdomain. The selector is a name your mailbox provider chooses, such as google for Google Workspace or selector1 and selector2 for Microsoft 365, so one domain can have several keys.
How do I find my DKIM selector?
Open an email you sent from the domain, show the original message (in Gmail: More, then Show original) and find the DKIM-Signature header. Its s= value is the selector and d= is the domain. Or choose Try common selectors.
What key length should a DKIM key have?
2048 bits. 1024 bit keys still work but are weaker, and many providers now create 2048 bit keys by default. Keys under 1024 bits are treated as if the mail was not signed.
What does t=y mean in a DKIM record?
It marks the domain as testing DKIM, and receivers may treat signatures as unverified. Remove it once signing works. t=s is different: it means the signing domain must match exactly, and is fine to keep.
Why is the key empty (p=)?
An empty p= tag means the key was revoked, usually after a key rotation. Mail still signed with that selector fails DKIM. Check which selector your provider signs with now.
Is the domain I enter stored?
No. The lookups go from your browser straight to Cloudflare's public DNS resolver. ZicReach does not see or keep the domain.