DKIM Record Checker
?About this tool, how to use it, and FAQ▾
What is a DKIM record checker?
DKIM (DomainKeys Identified Mail) lets a domain cryptographically sign its outgoing mail; receivers verify the signature against a public key published in DNS at selector._domainkey.yourdomain. This checker fetches that record for the selector you supply, parses its tags, and reports the key size with an assessment.
Compliance checks flag weak or malformed keys — a 1024-bit RSA key is considered the minimum today, and 2048-bit is the recommended standard.
How to use
- Enter the domain and the DKIM selector (the part before ._domainkey in the signing header, for example 'google' or 's1').
- Run the check to fetch selector._domainkey.domain from DNS.
- Review the parsed tags (v, k, p) and the key size assessment.
- Rotate to a 2048-bit key if the current key is 1024-bit or smaller.
Frequently asked questions
How do I find my DKIM selector?
Look at the DKIM-Signature header of an email your domain sent: the s= tag is the selector and d= is the domain. Providers use predictable selectors too — Google uses 'google', Microsoft 365 uses 'selector1' and 'selector2'.
What key size should a DKIM key be?
2048-bit RSA is the current recommendation. 1024-bit keys are still accepted but considered weak; anything smaller should be replaced immediately. Some providers rotate keys for you automatically.
Can a domain have more than one DKIM record?
Yes — each selector is an independent record, and domains routinely publish several (one per sending service, or two for zero-downtime key rotation). That is exactly why the checker asks for a selector.