What this checks
DKIM attaches a cryptographic signature to outgoing mail, and the receiver fetches your
public key from DNS to verify it. That key lives at
<selector>._domainkey.<domain>. This tool retrieves the key for the selector you
enter and reports its key type and whether a public key is actually published there.
How to read the results
A green badge means a public key is present at that selector and mail signed with the matching private
key can be verified. Key type is usually rsa (2048-bit is the modern
default) or ed25519. If the record exists but its p= value is empty, the key
has been revoked — the badge turns red — which is exactly what you'd expect for a selector a provider
has rotated away from.
DKIM selector pitfalls
- Checking the wrong selector. DNS gives no way to enumerate selectors — you have to
know the name. Guessing
defaultwhen your provider usesgooglereturns nothing, even though signing is working fine. - A revoked (empty) key. A published record with no
p=value is a tombstone left after a rotation; signatures made against it no longer verify. - Only one selector when a provider uses several. Some senders publish multiple selectors — one per service, or old and new during a rotation — and each must exist in DNS independently.
- Key too short. A 1024-bit RSA key still verifies but is increasingly distrusted; 2048-bit is the floor most providers now issue.
FAQ
How do I find my selector?
It isn't discoverable from DNS — read it off a message your domain already sent. Open the raw headers,
find the DKIM-Signature line, and the s= tag is the selector. Your email
provider's DNS setup docs list it too.
Can a domain have several DKIM keys?
Yes. Each selector is an independent key at its own _domainkey name, so a domain can carry
many at once — one per sending service, plus old and new selectors side by side during a rotation.
What key length should I use?
2048-bit RSA is the current default and what most providers issue; 1024-bit still verifies but is being
phased out. ed25519 keys are shorter and modern but not yet universally supported by
verifiers.
My provider rotated keys — is that normal?
Yes. Providers periodically publish a new selector and retire the old one, which is why an old selector can resolve to an empty, revoked record. As long as current mail carries a valid signature under the live selector, rotation is routine hygiene.