Free tool · Deliverability DKIM Checker

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email you send. The receiving server uses a public key published in your DNS to verify the message genuinely came from your domain and wasn't tampered with in transit. Along with SPF and DMARC, it's one of the three authentication standards inbox providers expect.

Enter your domain above. If you know your selector, add it; if not, we'll automatically try the most common ones (google, selector1, selector2, k1, default, and more). We look up the record at selector._domainkey.yourdomain.com, confirm a public key is published, and estimate the key strength.

A selector is a label that lets a domain publish multiple DKIM keys at once (for different sending services). It's part of the DNS name where the key lives: selector._domainkey.yourdomain.com. Google Workspace uses "google", Microsoft 365 uses "selector1" and "selector2", and many email platforms use "k1". You'll find yours in the DKIM setup screen of your email provider.

The most common reason is a custom selector we didn't guess. Check your email provider's DKIM/authentication settings for the exact selector name, then enter it above. The other possibility is that DKIM simply isn't set up yet, in which case your provider will have a one-time setup step that gives you a DNS record to publish.

2048-bit is the current recommendation. It's significantly harder to crack than 1024-bit, and all major providers support it. If our checker flags your key as 1024-bit and your provider allows it, regenerate at 2048-bit. The trade-off is that a 2048-bit key may need to be split across two DNS strings, which most DNS hosts handle automatically.