Home / Email Tools / DKIM Check
Email Tools
Retrieve and validate a selector public key.
DKIM Check retrieves the public key published in a domain's DKIM DNS record for a given selector and validates that it is a usable signing key. Enter a domain to auto-probe common selectors, or selector:domain for a specific one.
Enter a domain (example.org) to automatically probe common selectors, or selector:domain (s1:example.org) to query a specific selector. Run the tool to retrieve the DKIM public key.
Input: domain or selector:domain — e.g. example.org (or s1:example.org).
For each selector probed, the output shows whether a DKIM record was found, the key type (rsa/ed25519), the key length, and the published tags (v, k, s, t). A valid 2048-bit RSA key is the modern standard; a missing record for the selector your mail server signs with means recipients cannot verify your mail.
→ Confirm a DKIM public key is published for the selector you sign with.
→ Auto-probe common selectors when you do not know which is in use.
→ Verify key type and length meet modern recommendations.
→ Diagnose DKIM verification failures reported by recipients.
A selector is the label that identifies a specific DKIM key pair. The public key is published at selector._domainkey.example.org. A domain can have multiple selectors for different sending streams or key rotations.
Either DKIM is not configured, or your provider uses a selector that is not in the auto-probe list. Find the selector your provider documents (often in its admin console) and query it explicitly as selector:domain.
2048-bit RSA is the current standard and is widely accepted. 1024-bit keys still work but are being deprecated by some providers. Ed25519 is supported by a growing number of receivers and offers smaller signatures.