A free DKIM checker that finds your keys under the selectors services use, or the one you type, and reads each key's size.
5.0(1 rating)Type your domain, and your selector if you know it. See every DKIM key found, its size and the service behind it.
Your domain
DNS is read from your browser. navid.me fetches only the MTA-STS policy, the BIMI files and the domain's age. Nothing is stored.
This free DKIM checker finds your domain's DKIM keys under the selectors email services use, or the one you type, and reads each key's type and size.
It names the service behind each key from where its record points, and flags keys that are too short, revoked or in test mode.
What is a DKIM checker?
A DKIM checker looks up the public keys your domain publishes at selector._domainkey.yourdomain.com, which receiving servers use to check the signature on each email you send.
Why a checker has to guess selectors
DNS can't list a domain's keys: a key can only be asked for by its selector name. So every DKIM checker tries the names services use:
Amazon SES, HubSpot and Postmark put random or dated parts in theirs, which no list can guess. The email header analyzer reads the real one from the DKIM-Signature of an email you sent, and links back here with it.
How long should a DKIM key be?
RFC 8301 says receivers must not trust RSA keys under 1,024 bits, and signers should use at least 2,048.
A 1,024-bit key still passes. If your service offers 2,048 bits, rotate to it.
What a DKIM record says
| Tag | What it means |
|---|---|
| v=DKIM1 | A DKIM key |
| k=rsa | The key type: rsa or ed25519 |
| p= | The public key; empty means revoked |
| t=y | Test mode |
Final thoughts on DKIM
Every service that sends as you needs its own DKIM key on your domain, so its signature aligns with your From address for DMARC.
Set each one up in the service's domain settings, then check them all with the email deliverability checker.
Ready to send?
Email platforms that set up SPF, DKIM and DMARC with you
For developers: send from your own app
Where your domain and inbox live
DKIM Checker FAQs
Questions about DKIM? Here's what to know.
A DKIM checker looks up your domain's DKIM keys by their selector names, and checks each key's size and status.
A DKIM selector is the name a key is published under, at selector._domainkey.yourdomain.com.
Each email's DKIM-Signature header names its selector in s=.
Open an email you sent and look at its DKIM-Signature header: s= is the selector.
The email header analyzer reads it for you.
Your service may use a selector no checker can guess, like the random ones Amazon SES uses.
Type the selector from one of your emails and check again.
A 1,024-bit key still passes.
RFC 8301 says signers should use at least 2,048 bits, so rotate if your service offers it.
Yes, the DKIM checker is free, with no sign-up.
Navid Moazzez
AI business strategist & AI OS builder
Navid Moazzez helps creators and founders master AI and build their own AI Operating System (AI OS) to automate their business and life.
Navid.me is reader-supported. When you buy through links on this site, I may earn an affiliate commission. Learn more.
More free tools
X
Bluesky
LinkedIn
Threads
Mastodon
Instagram
TikTok
Pinterest
YouTube
Amazon KDP
Apple Books
Amazon
Substack
Spotify
Apple Podcasts
Free AI newsletterThe most actionable AI newsletter for founders
Every week, get proven AI strategies, curated tools, and step-by-step systems to grow your audience, create better content, and build a profitable creator business.
No fluff, no filler, no BS. Just five minutes each week that might level up your online business and life.
P.S. Sign up now to get free access to my ultimate AI tools guide for creators.
