DKIM checker

Sweeps the common DKIM selectors on your domain, shows every key it finds and flags keys shorter than 2048 bits.

SelectorLeave it empty to sweep 20 common selectors.

Reads public records only. Nothing is sent from your domain.Try

Ken checks DKIM on every inbox it sends from.

Connect your domains and Ken watches the keys and the rest of your DNS, and pauses an inbox before a send fails.

What the DKIM checker does

DKIM signs each outgoing message with a private key. The receiver fetches the public key from DNS at selector._domainkey.yourdomain.com and verifies the signature. If the message changed in transit or someone else signed it, the check fails.

Enter a domain and, if you know it, the selector. Without one, the checker tries about 20 common selectors, including google, selector1, selector2, k1, s1, s2, default, dkim and mail. For every key it finds it reports the key type, the key length and the tags in the record.

Finding your selector

DNS has no way to list selectors, so a sweep can only find the common ones. The reliable source is a message you sent. Open it, view the original or the source, and find the DKIM-Signature header. The s= tag is the selector and d= is the signing domain.

Google Workspace uses google by default. Microsoft 365 uses selector1 and selector2, published as CNAME records that point to Microsoft. Many sending tools use short names like k1 or s1.

If the sweep finds nothing, that doesn't prove DKIM is missing. Check a real message before you change anything.

How to read the key

v=DKIM1 is the version. It's optional, but if present it must come first.
k= is the key type. rsa is the default. ed25519 is defined in RFC 8463, but not every receiver verifies it.
p= is the public key. An empty p= means the key was revoked.
t=y marks testing mode, and RFC 6376 tells receivers to treat such mail as unsigned. Remove it once signing works.

RFC 8301 requires RSA keys of at least 1024 bits and says signers should use 2048. The checker flags 1024-bit keys. They still verify, but 2048 is the baseline today and every major provider offers it.

Why DKIM matters for cold email

DKIM survives forwarding when the message isn't changed, which SPF doesn't, and it's the authentication most sending tools can align with your domain. Gmail requires it from anyone sending around 5,000 or more messages a day to personal Gmail accounts.

For DMARC, the d= domain in the signature must match your From domain or share its organizational domain. If a tool signs with its own domain, DKIM passes and does nothing for your DMARC. Set up custom DKIM for every sending tool on every sending domain.

Questions

How do I find my DKIM selector?

Open an email you sent, choose Show original in Gmail or view the source elsewhere, and find the DKIM-Signature header. The s= value is the selector. Google Workspace uses google by default and Microsoft 365 uses selector1 and selector2.

Is a 1024-bit DKIM key still OK?

It verifies, and RFC 8301 still allows it, but it's the minimum. Use 2048-bit keys for new setups and replace old 1024-bit keys when you rotate. A 2048-bit key is too long for one TXT string, so DNS hosts store it as two or more strings in one record. That's normal.

Why does the checker say no DKIM record was found?

Either the domain doesn't sign, or it uses a selector outside the common list. Find the s= tag in a sent message and enter that selector. Also check the record really sits at selector._domainkey.yourdomain.com. Some DNS panels append the domain for you, which turns a full host name into selector._domainkey.yourdomain.com.yourdomain.com.

Do I need DKIM if I already have SPF?

Yes. SPF breaks when mail is forwarded, and it only aligns if your tool puts your domain in the Return-Path. DKIM survives forwarding when the message is unchanged. Gmail and Yahoo require both from bulk senders.

Can a domain have more than one DKIM key?

Yes, one per selector. Each sending service can have its own selector and key, and you rotate by publishing a new selector next to the old one, so mail still in transit keeps verifying.