DKIM Record Checker
Enter a domain (and optionally the selector) to fetch its DKIM public key at <selector>._domainkey.<domain>. We report the key type (RSA or Ed25519), the RSA bit length, and whether the key is in testing (t=y) or revoked (empty p=). If you don't know the selector, we probe the common ones used by major providers.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- Whether a DKIM key exists at the selector (or any common selector)
- Key type — RSA or Ed25519
- RSA key strength — 1024-bit (legacy) vs 2048-bit (expected by Gmail/Yahoo/Microsoft)
- Testing (t=y) and revoked (empty public key) flags
How to read the result
- OK = a published key that's 2048-bit RSA or Ed25519, not in testing.
- Warn (1024-bit) = it verifies, but major receivers now expect 2048-bit.
- Fail (revoked) = the public key is empty; signatures using this selector fail.
- Warn (not found) = no key at the queried selector — enable DKIM and publish the key.
Frequently asked questions
What is a DKIM selector?
A selector names which key to use, so a domain can run several keys at once. The public key lives at <selector>._domainkey.<domain>. The selector is carried in each message's DKIM-Signature (the s= tag).
I don't know my selector — can I still check?
Yes. If you leave the selector blank we probe common ones (google, selector1/2, default, k1, and others). To check a specific key, send a test message and read the s= tag from its DKIM-Signature header.
Is 1024-bit DKIM still OK?
It still verifies, but Google, Yahoo and Microsoft now expect 2048-bit. Rotate to a 2048-bit RSA (or Ed25519) key on a new selector.
What does a revoked DKIM key look like?
A record with an empty p= value (no public key). Receivers treat signatures for that selector as failing — restore a valid key or retire the selector.