Skip to content
inboxprobe

Checkers

Generators

Guides

Checkers

DKIM record checker

We probe the selectors Google, Microsoft 365, Mailchimp, SendGrid and others use, read each public key and check its length. Know your selector? Add it.

How DKIM works

Your sending service signs each message with a private key and adds a DKIM-Signature header. The header names a selector (s=) and a domain (d=). Receivers fetch the public key from <selector>._domainkey.<domain> and verify the signature. If the d= domain aligns with your From address, DKIM satisfies DMARC — and unlike SPF, it survives forwarding.

A DKIM public key (truncated)

Type
TXT
Host / name
google._domainkey
Value
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…

Why a checker can't simply “find” your DKIM

DNS has no way to list records, and selectors are arbitrary names. So every DKIM checker guesses. We try the selectors documented by the big providers plus common defaults, and tell you exactly how many we tried. “Not found” means “not at the usual names”, not “DKIM is off”.

ProviderSelector(s)Record type
Google Workspacegoogle (you can choose another)TXT
Microsoft 365selector1, selector2CNAME to Microsoft
Mailchimpk2, k3CNAME
Mailchimp Transactional (Mandrill)mandrill, mte1, mte2TXT / CNAME
SendGrids1, s2CNAME
Zoho Mailyou choose (often zmail)TXT
Proton Mailprotonmail, protonmail2, protonmail3CNAME
Fastmailfm1, fm2, fm3CNAME
cPanel / many hostsdefaultTXT

Finding your selector in 30 seconds

  1. Send yourself an email from the address you want to check (to a Gmail account if you have one).
  2. Open it and choose Show original (Gmail) or View source / message headers (Outlook, Apple Mail).
  3. Find DKIM-Signature: and read s= (the selector) and d= (the signing domain).
  4. If d= isn't your domain, the service signs with its own domain — DKIM passes but doesn't align for DMARC. Set up custom DKIM in that service.

Key length: 1024 vs 2048 bits

RFC 8301 requires receivers to reject RSA keys shorter than 1024 bits and recommends 2048. Google Workspace generates 2048-bit keys by default. A 1024-bit key still passes everywhere today; we flag it as a warning so you rotate when convenient. Ed25519 keys (RFC 8463) are short by design and shown as 256-bit.

Some DNS panels limit a TXT value to 255 characters and truncate a 2048-bit key. If your key shows as invalid, check that the whole p= value was saved — most panels accept it as one long value and split it automatically.

What we check in each key

  • The key parses (we decode the public key itself, not just the text) and its type: RSA or Ed25519.
  • RSA length: under 1024 fails, 1024 warns, 2048+ passes.
  • Revoked keys (empty p=), t=y test mode left on, h=sha1 (forbidden by RFC 8301), s= service restrictions.
  • CNAME delegation: where Microsoft 365 or SendGrid keys actually live.
  • Wildcard TXT records that answer for every selector and confuse receivers.

Questions

What is a DKIM selector?

A name that lets one domain publish several DKIM keys, one per service or per rotation. The key lives at <selector>._domainkey.<domain>, and each signed message says which selector to use in its DKIM-Signature header (s=).

Why does the checker say no DKIM was found when my mail is signed?

Your service probably uses a selector we don't guess, such as Postmark's date-based selectors or Amazon SES's random ones. Find s= in a sent message's DKIM-Signature header and enter it as a custom selector.

Is a 1024-bit DKIM key still OK?

It passes at Gmail, Yahoo and Outlook today. RFC 8301 recommends 2048 bits and Google generates 2048-bit keys by default, so rotate when convenient. Keys under 1024 bits are rejected.

Do I need DKIM if I have SPF?

Gmail, Yahoo and Outlook require both from bulk senders. Even below that, DKIM is what keeps DMARC passing when your mail is forwarded, because forwarding breaks SPF but not the signature.

Should I publish DKIM as TXT or CNAME?

Whatever your provider says. Google gives you a TXT record with the key; Microsoft 365, SendGrid and Mailchimp give you CNAMEs so they can rotate keys for you. Both work — receivers follow the CNAME.

Sources

Last reviewed: