Skip to content
Clinic open · free diagnosis, no appointment needed2,000+ domains monitored

DKIM record check

Probes the selectors real providers use, then measures the actual key, not just whether a record exists. Weak keys fail silently for years.

Judged against RFC 6376, with key requirements from RFC 8301 and Ed25519 from RFC 8463

Free, instant, no signup. This test reads your live DNS the way a receiving server does.

Symptoms

DKIM problems show up as deliverability that slowly gets worse, or as DMARC failures for mail that plainly came from you. Because a broken signature is treated as no signature, nothing bounces and nothing warns you, the mail simply carries less trust than it should.

  • A key published years ago at 1024 bits and never rotated.
  • A key truncated when it was pasted into a DNS panel that split the value.
  • An old selector left behind after a provider migration, next to the working one.
  • A record with t=y still set from the week DKIM was rolled out.

Diagnosis

DKIM signs your message with a private key your provider holds, and publishes the matching public key in DNS at selector._domainkey.yourdomain.com. A receiver reads the signature, fetches the key, and checks that the message has not changed in transit.

Why the key size matters

Verifiers must not accept RSA keys below 1024 bits, so a 512-bit key is not weak protection, it is none. At exactly 1024 the signature verifies, while the standard asks for 2048. This test decodes the published key and measures the modulus rather than guessing from the record's length.

Why we have to probe

There is no way to list a domain's selectors from DNS. Every checker guesses, and so do we, we try the selectors Google Workspace, Microsoft 365, Zoho, Mailchimp, SendGrid and the other common platforms use. If none answer, we say we did not find one, rather than telling you that you have no DKIM.

Cure

  1. No key found. Turn on DKIM signing in your mail provider, every major one offers it, and publish the record it gives you.
  2. Key under 2048 bits. Generate a new key at 2048, publish it on a new selector, switch signing over, and remove the old selector a few days later.
  3. Record unreadable. Republish it exactly as issued. Most failures are a DNS panel inserting spaces or line breaks into the key.
  4. Testing mode. Remove t=y once you have confirmed your mail verifies.

Questions people actually ask

How do I find my DKIM selector?

Open a message you sent, view its full headers, and look at the DKIM-Signature line. The s= value is the selector and the d= value is the signing domain. That is the only reliable way, DNS gives no index of selectors.

Is a 1024-bit DKIM key still acceptable?

It verifies, and it is the bare minimum receivers will accept. The standard asks for 2048 bits, and most providers rotate with one click. There is no reason to stay at 1024.

What does an empty p= mean?

It is a revocation. Publishing p= with nothing after it formally withdraws the key, and every signature made with it fails. If that was not deliberate, the key was truncated when it was pasted.

Why does this test say no key found when I have DKIM?

Because we probe the selectors common providers use, and yours may be custom. That result means "we guessed and missed", not "you have no DKIM", check your DKIM-Signature header and enter the selector directly.

Do I need DKIM if I already have SPF?

Yes. SPF breaks when mail is forwarded; DKIM survives it, because the signature travels with the message. DMARC passes if either aligns, so having both is what keeps legitimate mail delivering.

Related tests

Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.