DKIM checker: is your DKIM key published and strong enough?
Enter a domain, and the selector if you know it. Without one, we try the selectors used by Google Workspace, Microsoft 365, Mailchimp, SendGrid and other common services, then show each key we find.
Free, no signup. DNS lookups only: nothing is sent to the domain's mail server.
Why DKIM matters
DKIM signs every message with a key only your sending service holds, and receivers check the signature against the public key in your DNS. It proves the mail really came from your domain and was not changed on the way, and it is what DMARC relies on when mail is forwarded and SPF breaks.
Gmail and Yahoo require bulk senders to sign with DKIM. Check the rest of your setup with the SPF checker and DMARC checker.
DKIM checker FAQ
What is a DKIM selector?
The name your email service chose for its key, published at selector._domainkey.yourdomain. One domain can have several, one per sending service. Your service shows yours in its domain or DKIM settings (for example google for Google Workspace, selector1 and selector2 for Microsoft 365).
Why was no key found?
Either DKIM is not set up yet, or your service uses a selector we did not try. Amazon SES, Postmark and HubSpot generate their own unique selectors, so enter yours to check it.
Is a 1024-bit key good enough?
It works and receivers accept it, but 2048-bit keys are the current recommendation. Keys under 1024 bits are ignored by many receivers. Most providers let you rotate to a 2048-bit key in their settings.
What does t=y mean?
Testing mode: receivers may treat a DKIM failure as if the message were unsigned. It is meant for the first days of setup; remove it once signing works.
Does a valid key mean my mail passes DKIM?
Only if your service actually signs with that selector and the message is not altered on the way. Send yourself a test message and check its Authentication-Results header for dkim=pass.
More free tools
- MX lookup
See a domain's mail servers and which provider runs them.
- SPF checker
Check the SPF record, its DNS lookup count and the all mechanism.
- DMARC checker
Read the DMARC policy, reporting address and what to tighten.
- BIMI checker
See whether inboxes can show your logo, and what is missing.
- Disposable email checker
Find out if a domain is a throwaway inbox service.
- SPF record generator
Build a correct SPF record for the services that send your email.
- DMARC record generator
Create a DMARC record, from monitoring to full protection.
- Free email verifier
Check whether one address actually exists, with a live mailbox check.
A healthy domain is half of it. Verify the addresses too.
Free credits on sign-up. No card. You only pay for definite answers.
Start free