DKIM record checker
Enter your domain and we'll scan common selectors to find your DKIM key and measure its strength. If you know your selector, put it in the second field — if not, leave it empty and we'll try 34 common ones.
No signup, no email required. Only public DNS records are read.
What is a selector and how do I find it?
A DKIM record doesn't live on the domain itself but under a selector name. One domain can have several selectors — every sending service publishes its own key.
| Provider | Typical selector |
|---|---|
| Google Workspace | google (date-based on some accounts: 20230601) |
| Microsoft 365 | selector1, selector2 |
| Zoho Mail | zoho, zohomail |
| Mailchimp | k1 |
| SendGrid | s1, s2 |
| Amazon SES | amazonses or a generated name |
| mailcow / FelixMail | dkim |
What is DKIM?
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every message you send. The public key needed to verify it is published in DNS; the receiving server checks the signature against that key and confirms the message wasn't altered in transit and really came from your domain.
The difference from SPF matters: SPF looks at the sending server's IP, DKIM at the message itself. So when mail is forwarded, SPF usually breaks while the DKIM signature survives. DMARC only needs one of the two to pass, which is why domains with DKIM have far fewer problems with forwarding.
1024 or 2048 bit?
The current recommendation is 2048. 1024-bit keys are still accepted but considered weak, and large providers are steadily reducing the trust they extend to them.
The only practical difficulty with 2048 is that the record exceeds 255 characters and some DNS panels won't take it on one line. The fix is splitting it into two strings, which most panels do automatically. If your provider supports 2048, there's no reason to stay at 1024.
Key rotation: when to delete the old one
A common mistake when rotating is publishing the new selector and deleting the old one the same day. Mail sitting in a queue or processed late by the receiver is still signed with the old key, and deleting it makes those signatures unverifiable.
The right order: publish the new selector, switch sending to the new key, leave the old selector in DNS for at least a week, then revoke it by emptying 'p=', and finally delete the record.
Is having several selectors normal?
Yes — it's expected. If your own mail server, marketing tool, billing system and CRM all send as you, each publishes its own DKIM key under its own selector.
This creates no constraint like SPF's 10-lookup limit: DKIM has no upper bound on selectors, because a receiver only queries the single selector named in the message's signature.
Frequently asked questions
How do I find my DKIM selector?
Send yourself a message and view its source. The 's=' value in the 'DKIM-Signature' header is your selector. It's also shown on your mail provider's DNS setup page.
The tool couldn't find my DKIM record — does that mean I don't have one?
No. DKIM selector names can't be enumerated over DNS, so the tool can only try common ones. A custom selector simply won't be found — which is why we don't assign a grade in that case. Enter your selector in the second field for a definitive answer.
Can I send mail without DKIM?
You can, but your mail is noticeably more likely to land in spam. And because SPF breaks when mail is forwarded, DMARC will fail in that case too — DKIM is your only protection in that scenario.
How often should I rotate my DKIM key?
There's no mandatory interval. Rotating once a year is good practice; if you suspect the key has leaked, rotate immediately.
Is this tool free? Do I need an account?
It's completely free and requires no account or email address. It only reads public DNS records.