DKIM record checker
Validate a DKIM public key — or leave the selector empty and we search 80 common selectors for you.
5 free checks per day · then from $0.04 per check — pricing
What the DKIM Checker checks
- Record syntax (v=, k=, p=, t=, h=, s=)
- RSA key length — 2048 bits recommended
- Ed25519 keys (RFC 8463)
- Revoked keys (empty p=)
- Testing mode t=y and SHA-1 only keys
- CNAME delegation to your provider
How it works
- 1
Enter your domain and selector (or leave the selector empty)
- 2
We validate the key or search common selectors
- 3
Fix weak or broken keys
Frequently asked questions
Where do I find my DKIM selector?
Open a message you sent, view the original/source and find the DKIM-Signature header. The selector is the value of s= (for example s=google or s=selector1).
Is a 1024-bit key still OK?
It still verifies at most providers, but 2048 bits is the current recommendation by Google, Microsoft and M3AAWG. Keys under 1024 bits are rejected.
Why can't you list all my selectors?
DNS has no way to list them. Selectors are only discoverable if you know or guess the name — which is why we try 80 common ones.