Free tool
Free DKIM Checker & Analyzer
Enter a domain and selector to look up its DKIM public key. This free DKIM analyzer shows the published record, estimates the key size, flags revoked or weak keys, and checks SPF, DMARC and MX at the same time.
Leave the selector blank to try google, selector1, selector2, default and k1. Checks SPF, DKIM, DMARC and MX records live. Free, no sign-up.
Reading the report
How to read the DKIM analyzer results
The checker fetches the TXT record at selector._domainkey.yourdomain.com and reads its p= tag, which holds the public key. Each line in the DKIM card means one of the following.
| Result | What it means | What to do |
|---|---|---|
| Key published at selector “google” | A DKIM key exists at that selector. Receivers can find it. | Nothing, if this is the selector your provider signs with. |
| Key size: about 2048 bits or more | Pass. Matches what RFC 8301 and Google recommend. | Nothing. Rotate it on your normal schedule. |
| Key size: about 1024 bits | Warning. Valid, but below the recommended size. | Rotate to a 2048-bit key (steps below). |
| Key looks shorter than 1024 bits | Fail. RFC 8301 tells receivers not to accept signatures from keys under 1024 bits. | Generate a new 2048-bit key now. |
| Empty p= tag: key revoked | Fail. RFC 6376 defines an empty p= as a revoked key. | Publish a new key, or stop signing with this selector. |
| No p= tag found | Warning. The record exists but holds no key, often a paste error. | Copy the full value from your provider again. |
| No DKIM key at common selectors | Warning. Nothing at google, selector1, selector2, default or k1. | Find your selector (next section) and enter it. |
| Nothing at selector “x”; showing “y” | Warning. Your selector is empty but another one has a key. | Check you typed the selector your provider actually uses. |
The key size is an estimate from the length of the published key: a 2048-bit RSA key is roughly 390 characters of base64, a 1024-bit key roughly 215. The checker also recognizes Ed25519 keys (k=ed25519).
A published key doesn't prove your mail is signed
dkim=pass in its headers. In Google Workspace, signing only starts after you click Start authentication; in Microsoft 365, after you turn on DKIM signing for the domain.Same lookup from a terminal
dig TXT google._domainkey.acme.io +short
# Microsoft 365: the CNAME resolves to the key Microsoft hosts
dig TXT selector1._domainkey.acme.io +shortSelectors
What is a DKIM selector?
A selector is the name of one DKIM key. It lets a single domain publish several keys at once: one per sending service, or an old and a new key during rotation.
Every DKIM signature carries two tags that point to the key: d=, the signing domain, and s=, the selector. The receiver joins them into a DNS name, selector._domainkey.domain, and fetches the public key from there. So s=google; d=acme.io means the key lives at google._domainkey.acme.io.
How to find your DKIM selector
- From a sent email: open a message you sent to an outside address, choose Show original in Gmail or view the message source or internet headers in Outlook, and find the
DKIM-Signatureheader. The value afters=is the selector. Gmail also shows it asheader.s=in the Authentication-Results line. - From your provider: Google Workspace shows it under Apps › Google Workspace › Gmail › Authenticate email. Microsoft 365 shows it on the DKIM tab of Email authentication settings in the Defender portal.
- From another sending tool: the CNAME or TXT names on its domain-authentication screen contain the selector, the part before
._domainkey.
Example: a DKIM-Signature header (shortened)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=acme.io; s=google; t=1761120000;
h=from:to:subject:date:message-id;
bh=…;
b=…Common DKIM selectors by provider
| Provider | Selector(s) | What you publish | Key size |
|---|---|---|---|
| Google Workspace | google | One TXT record at google._domainkey. The prefix can be changed. | 2048-bit recommended; 1024-bit if your DNS host can't store 2048 |
| Microsoft 365 | selector1, selector2 | Two CNAMEs pointing to keys Microsoft hosts. It alternates between them when keys rotate. | 1024 or 2048; New-DkimSigningConfig defaults to 1024 |
| SendGrid | s1, s2 | CNAMEs with automated security on; one selector signs at a time. | Managed by SendGrid |
| Mailchimp | two CNAMEs, e.g. k2 | Two CNAME records shown on your Domains page. | Managed by Mailchimp |
| Amazon SES (Easy DKIM) | Three random tokens | Three CNAMEs: token._domainkey pointing to token at the SES DKIM zone. | 2048-bit by default; 1024-bit optional |
Using a CRM, help desk or newsletter tool as well? Each one that sends as your domain needs its own selector. If two services ask for the same name, change the prefix on one of them so they don't overwrite each other.
Key length
DKIM key length: 1024 vs 2048 bits
RFC 8301 says signers must use RSA keys of at least 1024 bits and should use at least 2048. Longer keys are harder to crack, but they make the DNS record longer.
Length of the p= value by RSA key size
Characters of base64 in the DKIM record, measured on keys generated with OpenSSL. One TXT string holds 255 characters, so 2048-bit and larger keys must be split into several strings.
| 512-bit (invalid) | 128 chars |
|---|---|
| 1024-bit (minimum) | 216 chars |
| 2048-bit (recommended) | 392 chars |
| 4096-bit | 736 chars |
| Key size | Status | Notes |
|---|---|---|
| Under 1024 bits | Invalid | RFC 8301: receivers must not treat these signatures as valid. |
| 1024 bits | Minimum allowed | Fits in a single TXT string. Google offers it only for DNS hosts that can't store 2048. |
| 2048 bits | Recommended | RFC 8301's “should”. Google recommends it; Amazon SES uses it by default. |
| 4096 bits | Allowed | Receivers must be able to verify keys up to 4096 bits, but the record is more than three times as long as a 1024-bit one. |
How to move from 1024 to 2048 bits
- Google Workspace: generate a new 2048-bit record in Authenticate email, replace the TXT value at your DNS host, then click Start authentication again. Google says it can take up to 48 hours to start working.
- Microsoft 365: run
Rotate-DkimSigningConfig -Identity acme.io -KeySize 2048. Microsoft notes the new size applies to the next active selector, so the second selector moves to 2048 bits on the following rotation. - Amazon SES: switch the DKIM signing key length to RSA_2048_BIT in the identity's settings. SES allows at most one key-length change per 24 hours.
DNS host cuts the key off?
p= tag after an edit, the host probably truncated it.How it works
How DKIM signing works
DKIM is public-key cryptography applied to email. Your provider signs, DNS publishes the matching public key, and the receiver checks the two against each other.
How DKIM signing and verification work
The private key never leaves the sending server. Only the public key is published in DNS.
The signature covers the body and a list of headers (the h= tag). If anything in those changes after signing, such as a gateway adding a footer, the hashes no longer match and DKIM fails. That is also why DKIM can survive plain forwarding while SPF usually breaks: the signature travels with the message instead of depending on which server delivered it. See how the two work together with DMARC in SPF vs DKIM vs DMARC.
Rather not manage DKIM keys at all?
Jetmail creates Google and Microsoft mailboxes on your domains and publishes SPF, DKIM and DMARC for every one of them automatically.
Troubleshooting
DKIM fail: causes and fixes
Receivers record a DKIM result in the Authentication-Results header of every message. Match what you see there with the checker's output to find the cause.
| What the headers show | Likely cause | Fix |
|---|---|---|
| dkim=none, no DKIM-Signature header | Signing isn't turned on, even if the key is published. | Start authentication (Google) or turn on DKIM signing (Microsoft 365). |
| Key not found / no key for signature | Nothing is published at the selector in s=. The checker shows a warning for that selector. | Publish the record at exactly selector._domainkey.yourdomain.com. |
| dkim=fail, body hash did not verify | The message was changed after signing: a footer, disclaimer or link rewrite. | Stop the change, or have the system that changes mail sign after it. |
| dkim=fail, signature did not verify | The key in DNS doesn't match the private key: it was regenerated but DNS still has the old value. | Copy the current value from your provider and compare it with the checker output. |
| dkim=fail or permerror, key revoked | The record has an empty p= tag. | Publish a new key and sign with it. |
| Signature ignored as too weak | The key is under 1024 bits. | Rotate to 2048 bits. |
| dkim=pass, but DMARC fails | The message was signed with your provider's domain in d=, not yours. | Fix DMARC alignment |
Setting DKIM up from scratch or switching DNS hosts? Follow the step-by-step DKIM setup guide for Google Workspace and Microsoft 365, including where to paste the record at GoDaddy, Cloudflare, Namecheap and Squarespace.
Next steps
After the DKIM check
- DKIM is one of three records receivers look for. Check the whole domain with the domain health checker.
- DKIM only helps DMARC when the
d=domain matches your From address. Review your policy with the DMARC checker. - Sending cold email? Keep it on separate domains so a reputation problem never reaches your main one. Jetmail sets up Google Workspace mailboxes with DKIM already signing, as part of its cold email infrastructure.
Sources (checked October 2026): RFC 6376 (DKIM) · RFC 8301 (DKIM key sizes) · Google: set up DKIM · Microsoft: DKIM for custom domains · Twilio SendGrid: DKIM records · Mailchimp: email domain authentication · Amazon SES: Easy DKIM · Amazon SES: managing Easy DKIM
Get a free DKIM fix list
Tell us where to send it. We'll reply with mailbox, domain and DNS recommendations for your sending volume — or start right away and have mailboxes live in minutes.
Where should we send it?
Or see pricing →Frequently asked questions
How do I check my DKIM record?
Enter your domain and, if you know it, your selector in the DKIM checker above. It looks up the TXT record at selector._domainkey.yourdomain.com, estimates the key size and flags revoked or malformed keys. From a terminal, run: dig TXT google._domainkey.yourdomain.com +short (swap google for your selector).
How do I find my DKIM selector?
Open an email you sent, view the original message or its headers, and find the DKIM-Signature line. The value after s= is the selector. In Gmail, Show original also lists it in the Authentication-Results line as header.s=. Your provider's admin console shows it too.
What is an example of a DKIM selector?
Google Workspace uses google by default, Microsoft 365 uses selector1 and selector2, and SendGrid uses s1 and s2. A signature with s=google and d=acme.io means the public key lives at google._domainkey.acme.io.
Why does the checker say no DKIM key was found?
Either DKIM isn't published yet, or your provider uses a selector the checker doesn't try by default. Without a selector it tests google, selector1, selector2, default and k1. Find your real selector in a sent message's headers and enter it in the selector box.
What does an empty p= tag mean?
RFC 6376 defines an empty p= value as a revoked key. Any mail still signed with that selector fails DKIM. Publish a new key and make sure your provider signs with it, or remove the old selector once nothing uses it.
Is a 1024-bit DKIM key still OK?
It still verifies: RFC 8301 sets 1024 bits as the minimum. The same RFC says signers should use 2048-bit keys, and Google recommends 2048 bits wherever your DNS host can store them. Treat a 1024-bit result as a reminder to rotate.
If DKIM passes, will my email reach the inbox?
Not on its own. DKIM proves the message came from your domain unaltered. DMARC also needs SPF or DKIM to align with the From domain, and inbox placement still depends on reputation, volume, list quality and spam complaints.