DKIM checker
Check a DKIM record for a selector: key type and length, testing mode and revoked keys. Look up selector._domainkey.domain in DNS or paste the record.
Runs in your browser · nothing is sentEmail securityNew
A look-up sends only the domain name and the record type to Cloudflare’s DNS service (cloudflare-dns.com). Nothing else leaves your browser. Choose “Paste records” to stay fully offline.
How to use
- Enter your domain and the selector from a DKIM-Signature header.
- Select Check. The tool reads selector._domainkey.your-domain.
- Fix the findings, for example by creating a 2048-bit key under a new selector.
Common scenarios
Publish the new key under a new selector, check it here, then switch your mail system to it.
Check that the selector exists, the key is complete and testing mode is off.
DMARC analyzer →About this tool
Enter a domain and the DKIM selector to read selector._domainkey.domain from DNS, or paste the record to stay offline. The tool checks the syntax, reads the key type and length and warns about short keys, testing mode and revoked keys. A selector cannot be found from the domain alone: look for s= in the DKIM-Signature header of a message you sent.
🔒 Your input stays in your browser and is never sent anywhere.
Frequently asked questions
Where do I find my DKIM selector?
Open the headers of a message sent from your domain and look at the DKIM-Signature header. The s= tag is the selector and d= is the domain. Common selectors are selector1, selector2, google, default, k1 and s1.
Is a 1024-bit key still fine?
1024-bit RSA keys are considered weak. Use 2048 bits. Many DNS providers need the key split into two quoted strings because of the 255-character limit per string.
What does t=y mean?
It marks the domain as testing DKIM. Receivers may treat failing signatures as if there were none. Remove it when you have finished testing.
What to do next
Found a problem or have a suggestion? Tell us