DKIM checker
Check a domain's DKIM keys. We detect the mail provider and try the selectors it uses, plus any selector you enter, then check each key.
How DKIM checking works
Each sending service publishes its public key at <selector>._domainkey.<domain>. This tool reads the domain's MX records to detect the mail provider, tries the selectors that provider uses, and checks each key it finds. More in how to find a DKIM selector.
Frequently asked questions
Why can no tool list all DKIM selectors?
DNS has no way to list the names under _domainkey, so a checker can only try selectors it knows or that you enter. A result of "not found" means "not found on the selectors tried", not "DKIM is missing".
Where do I find my DKIM selector?
Open the headers of an email you sent and find the DKIM-Signature header: s= is the selector and d= is the signing domain.
What DKIM key size should I use?
2048-bit RSA where your provider supports it. 1024-bit keys still work but are weaker; an empty p= value means the key was revoked.
Related guides
find DKIM selector
How to find a domain's DKIM selector (and why you can't list them all)Three reliable ways to find the selector, the common defaults by provider, and why "DKIM missing" is a claim no outside tool can make.
Microsoft 365 DKIM setup
Microsoft 365 DKIM setup: selector1, selector2 and the CNAME recordsStep-by-step DKIM for a custom domain in Microsoft 365, how to confirm it is working, and what to do when the portal will not enable it.
Google Workspace DKIM setup
Google Workspace DKIM, SPF and DMARC setup checklistSPF, DKIM and DMARC for a Google Workspace domain, in the order that avoids broken mail, with how to check each step.