About this tool
DKIM (DomainKeys Identified Mail, RFC 6376) lets a sender sign each message. Receivers fetch the public key from DNS at <selector>._domainkey.<domain> and check the signature.
A domain can have many keys, one per selector, and there is no way to list them from DNS. To check the right key, take the selector from a real message: open its headers and find DKIM-Signature: … d=example.com; s=selector; ….
How to read the results
- k= key type: rsa (default) or ed25519.
- Key size: RSA 2048 bits is the current recommendation; 1024 still verifies; below 1024 is rejected (RFC 8301).
- p= empty means the key has been revoked.
- t=y testing mode; t=s the signing domain must match exactly (no subdomains).
- If the selector is a CNAME (common with Microsoft 365 and e-mail services), the alias chain is shown.
Limitations
- A published key does not prove that mail is being signed with it, or that signatures verify. Only a received message's headers show that — use the e-mail header analyzer.
- "Try common selectors" checks a short list of popular names. Finding nothing there does not mean the domain has no DKIM.
Frequently asked questions
Where do I find my DKIM selector?
Send yourself an e-mail, view the original/raw message, and look at the DKIM-Signature header: the value after s= is the selector and d= is the signing domain. Your e-mail provider's DKIM setup page also shows it.
What are the selectors for Google Workspace and Microsoft 365?
Google Workspace uses google by default (you can choose another). Microsoft 365 uses selector1 and selector2, published as CNAMEs to Microsoft.
Should I rotate DKIM keys?
Yes, periodically (for example every 6–12 months): publish a new selector, switch signing to it, then revoke the old key by emptying its p= value.
Why is my DKIM record split into several quoted strings?
A single DNS text string can hold at most 255 characters, so 2048-bit keys are split into several strings in one record. Receivers join them back together; this tool shows the joined value.
Where is a DKIM key stored?
A TXT record at selector._domainkey.yourdomain.
What key size should DKIM use?
RSA 2048 bits.
What does an empty p= mean?
The key has been revoked.