DKIM adds a digital signature to every email you send, and publishes the key that checks it in your domain’s DNS. When a message arrives, the receiving server uses that key to confirm the mail really came from your domain and wasn’t changed along the way. The checker above finds your DKIM keys, measures their strength, explains each setting and shows how they fit with your SPF and DMARC records.

What DKIM Does

DKIM stands for DomainKeys Identified Mail. Your email service signs each outgoing message with a private key that only it holds. The matching public key sits in a TXT record in your DNS. A receiving server reads the signature, fetches the public key and checks that the two match. If someone forged the message or changed it in transit, the check fails.

DKIM has one big advantage over SPF: the signature travels with the message. When mail is forwarded, SPF usually breaks because the forwarding server isn’t on your list, but the DKIM signature often survives. That is why DMARC can pass on DKIM alone, and why every service that sends as your domain should sign with DKIM.

What a Selector Is

A domain can have many DKIM keys at once, one for each service that sends its mail. Each key lives under its own name, called a selector. The full DNS name is the selector, then _domainkey, then your domain. Google Workspace uses google by default, Microsoft 365 uses selector1 and selector2, and Mailchimp uses k1, k2 and k3.

There is no way to list every selector a domain uses, because DNS only answers questions about names you already know. When you leave the selector blank, the checker tries more than 50 common selectors used by popular email services. If your service uses an unusual or random selector, enter it yourself.

How to Find Your Selector

The quickest way is to look at an email you sent. In Gmail, open the message, click the three-dot menu and choose Show original. In Outlook, open the message and view its source or message details. Find the line that starts with DKIM-Signature. The value after s= is the selector and the value after d= is the signing domain.

If the d= value is your email service’s domain rather than yours, the service is signing with its own key. The message still passes DKIM, but it won’t count toward DMARC for your domain, because DMARC needs the signing domain to match your From address. Most services have a setup page that switches signing to your own domain.

How to Read Your Result

The headline tells you whether DKIM looks healthy:

• DKIM is set up: at least one working key was found, and none have problems
• DKIM works, with warnings: a key was found but is weaker than recommended, or is still marked as testing
• DKIM has problems: a key is broken, too weak to be trusted, or published twice
• No keys found: nothing is published under the selectors checked, so check the selector in a message header
• Only revoked keys found: every key found has been switched off on purpose

Each key gets its own section showing the record name, the key type and length, whether testing mode is on, and the full published record.

Key Length: 1024 vs 2048 Bits

Most DKIM keys use RSA, and their strength depends on their length. The DKIM standard was updated in 2018, in RFC 8301, to require keys of at least 1024 bits and to recommend 2048 bits. Keys shorter than 1024 bits are ignored by many receivers, so mail signed with them is treated as unsigned.

A 1024-bit key still works today, but 2048 bits is the safer choice and is what most large providers now generate by default. If the checker shows a 1024-bit key, ask your email provider to generate a new 2048-bit key, publish it under a new selector, switch signing to it and then remove the old one.

Some domains also publish an Ed25519 key, a newer and shorter type of key that is just as strong. Not every receiver supports it yet, so it is usually published alongside an RSA key rather than instead of one.

Other DKIM Settings

A DKIM record is a list of tags separated by semicolons. Only the key itself is required, but a few other tags matter:

• Version (v=DKIM1): marks the record as DKIM and is optional, though most records include it
• Key type (k): rsa, which is the default, or ed25519
• Public key (p): the key itself, written as a long string of letters and numbers; an empty value means the key has been revoked
• Testing (t=y): tells receivers the domain is still testing DKIM, so some treat its signatures as if they weren’t there
• Hash (h): limits which hash methods may be used; if it allows only sha1, signatures will fail, since SHA-1 is no longer accepted

Common DKIM Problems

Most broken DKIM setups come down to a handful of mistakes:

• The key was pasted with a typo or a missing chunk, often because the DNS provider split a long value incorrectly
• The record was added at the wrong name, such as with the domain repeated twice at the end
• Two records were published at the same selector, so receivers may read the wrong one
• Testing mode was turned on during setup and never turned off
• A service signs with its own domain instead of yours, so DKIM passes but doesn’t align for DMARC
• An old 1024-bit key was never rotated

Rotating DKIM Keys

Changing keys from time to time limits the damage if a private key is ever exposed. Many providers rotate automatically, which is why some publish their selectors as CNAME records pointing to keys they manage. When you rotate by hand, publish the new key under a new selector first, switch your service to sign with it, wait a few days for mail in transit to be delivered, and then revoke the old key by emptying its p= value.

DKIM, SPF and DMARC Together

The three records do different jobs. SPF lists the servers allowed to send for your domain, DKIM proves each message is genuine and unchanged, and DMARC tells receivers what to do when both checks fail and sends you reports. Google, Yahoo and Microsoft require bulk senders to have all three, and set up together they give your mail the best chance of reaching the inbox while making your domain much harder to fake.

The checker shows your SPF and DMARC status alongside DKIM, with links to check each one in detail.