Free DKIM checker
Is your mail cryptographically signed?
There's no DNS record that lists a domain's DKIM selectors, so we probe the ~20 most common ones used by major email providers and show you what's live.
How selector discovery works
Since DNS has no way to list a domain's DKIM selectors, we check around twenty of the most common ones used by major platforms — Google Workspace, Microsoft 365, Mailchimp, SendGrid, Mandrill, Zoho, and others — by looking up selector._domainkey.yourdomain.com for each candidate name.
Any selector that resolves to a valid key gets shown, along with a rough read on its key strength. If your provider uses an unusual selector name, the manual lookup box lets you check it directly — your provider's DKIM setup instructions will usually tell you the exact name to use.
Common questions
What is a DKIM selector, and why do I need to guess it?+
DKIM keys live at a DNS name like selector._domainkey.yourdomain.com, where "selector" is a name your email provider chooses — there's no directory or DNS record that lists which selectors a domain uses. Providers usually pick a predictable name (google, default, s1, mandrill), which is why probing common ones finds most real-world setups.
This tool didn't find anything — does that mean DKIM is broken?+
Not necessarily. It means none of the ~20 common selectors we check are active for this domain. Many providers use a custom or dated selector (like s20240115). Check your email platform's DKIM setup page for the exact selector, then use the manual lookup box to check it directly.
What does the key size (1024-bit vs 2048-bit) mean?+
It's the strength of the cryptographic signature. 1024-bit keys are considered weak by modern standards and some major providers are phasing out support for verifying them. If your setup shows a 1024-bit key, ask your provider about rotating to 2048-bit.
Can a domain have more than one active DKIM selector?+
Yes, and it's common — each sending platform you use (your CRM, your email marketing tool, your helpdesk) may sign with its own selector. This tool lists every active selector it finds, not just the first one.
How does DKIM relate to SPF and DMARC?+
DKIM proves a message wasn't altered in transit and was signed by a key your domain published. DMARC checks whether that DKIM signature (or SPF) aligns with your domain before deciding what to do with mail that fails. All three work together — check your SPF and DMARC setup too for the full picture.
More free checks