Free · no sign-up
Free DKIM check
Find the DKIM keys your domain publishes and check that they are long enough to be trusted.
3 of 3 free checks left today · No sign-up. Public DNS data only.
What DKIM is and why it matters
DKIM adds a digital signature to every email you send. The public key that verifies it is a TXT record at selector._domainkey.yourdomain.com, where the selector is chosen by your mail provider.
A valid signature proves the email was not changed and really came from a server you trust. Unlike SPF, DKIM survives forwarding, which makes it the more reliable half of DMARC.
google._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…"google is the selector. p= holds the public key; use 2048-bit RSA.
Common problems we find
Signing not turned on
Many providers publish nothing until you enable DKIM in their settings.
1024-bit keys
Short keys are considered weak. Rotate to 2048-bit.
Old selectors left behind
Keys of services you no longer use can still sign email in your name.
How to fix it
- 01Turn on DKIM in each service that sends your email.
- 02Publish the TXT or CNAME record it gives you, exactly as shown.
- 03Remove keys of services you have stopped using.
Questions
Why does the check say no key was found when DKIM works?
DNS has no list of selectors, so we try the common ones. If your provider uses a custom selector, the free check cannot see it. With an account you can add your selectors.
More checks: DMARC · SPF · DNSSEC · All DNS checks
Check the whole domain, not just one record
The free check covers SPF, DKIM, DMARC and MX in one go.