Free tool
Find a domain's DKIM key, read it properly — type, size, and whether it is revoked or still in test mode. Know your selector? Enter it. If not, we try the ones the major providers use.
DKIM signs the message. The sending server hashes a set of headers and the body, signs the hash with a private key, and attaches the result as a DKIM-Signature header. The receiver fetches the matching public key from your DNS and checks it.
That makes DKIM the half of authentication that survives forwarding — the signature travels with the message, while SPF only describes the server that happened to hand it over.
At <selector>._domainkey.yourdomain, as a TXT record holding v=DKIM1, the key type, and the key itself in p=. The selector is why a domain can publish several keys at once, which is what makes rotation possible without an outage: publish the new key at a new selector, switch signing to it, remove the old one a week later.
p=, and every signature made with it fails. t=y), which tells receivers not to act on a failure. A signature nobody is required to check protects nothing: a forged message simply arrives unsigned. What makes DKIM binding is DMARC, which tells receivers to act when neither DKIM nor SPF aligns with the domain in the From header.
A selector is a label that lets one domain publish several keys — the record lives at <selector>._domainkey.yourdomain. Whoever signs your mail chooses it and shows it in their DNS instructions: Google Workspace uses google, Microsoft 365 uses selector1 and selector2, and a self-hosted server usually uses default or mail. You can also read it from the s= tag of the DKIM-Signature header on any message you have sent.
No, and it deliberately does not say that. There is no record anywhere listing a domain's selectors, so a sweep can only report the selectors it tried. A domain signing with a private selector is configured correctly and invisible to any guess.
It still verifies everywhere today. Google, Microsoft and Yahoo now recommend 2048, and 1024 is the size that will be deprecated first. Rotating is a DNS change and a restart, so it is worth doing before it becomes urgent.
Test mode: receivers are told to treat a failed signature as if the message were unsigned. It exists so you can publish a key before you trust it, and it is routinely left behind after a migration — at which point DKIM is published, visible, and doing nothing.
Almost always the value was truncated or re-wrapped by the DNS panel. A 2048-bit key is 392 characters and must be split into quoted chunks, which some panels do for you and some do not. Republish it as a single value and let the panel chunk it.