The key is published
We look for the record at selector._domainkey.domain. Without a key there, mail signed with that selector fails the check even though the server signs it.
DKIM record checker
DKIM lets recipients check that a message was signed by your domain’s server and has not changed since. We find the public key in DNS and check its properties. Verifying the signature on a specific message requires its source, which this tool does not analyze.
Check a DKIM key
Enter a domain and selector, the name of the DKIM key. Find it in your mail settings or after s= in a message’s DKIM-Signature header. If you do not know it, leave the field empty and we will try 29 common selectors.
What we check in DKIM
Key length
Recipients don’t accept RSA keys shorter than 1024 bits; 2048 is recommended. Ed25519 keys are short by design and strong.
A revoked key
A record with an empty p= is how an old key is retired. It isn’t an error on its own as long as another selector works.
DKIM questions
Where to find the selector, which key you need and how to rotate it.
Where do I find the DKIM selector?
Open any message sent from the domain and look at its headers: in email apps this is “Show original” or “View source”. In the DKIM-Signature header the selector follows s= and the domain follows d=. The selector is also in your mail service settings, next to the DKIM key. Plesk usually uses default, Google Workspace google, Microsoft 365 selector1 and selector2: we check those ourselves.
How long should a DKIM key be?
RSA at 2048 bits is what is recommended today and accepted by every large mailbox provider. 1024 bits still works but is considered weak; shorter keys aren’t accepted at all. A 4096-bit key is stronger but doesn’t fit in one TXT string, and some DNS panels break it. If your service offers Ed25519, add it as a second selector next to RSA.
How do I rotate a DKIM key without losing mail?
Use a new selector. Publish the new key under another name, such as 2026 instead of default, wait until the record has propagated, and switch signing to the new selector in your mail settings. Keep the old key for another week: mail signed with it may still be sitting in queues. Then empty its p= value or delete the record.
More tools: Domain email
Email settings checker
MX, SPF, DKIM, DMARC and blacklists in one go, scored out of nine.
OpenSPF checker
Check an SPF record for errors, the DNS lookup limit and sender rules.
OpenDMARC checker
Whether there is a record, which policy it sets and where reports go.
OpenMX lookup
The domain’s mail servers, their addresses, reverse DNS and encryption.
OpenBlacklist check
Check an IPv4 address or a domain’s mail server IPs against blacklists.
OpenSPF generator
Choose your mail senders to create an SPF record for DNS.
OpenDMARC generator
Choose how to handle messages and where to send DMARC reports.
OpenEmail on your own domain comes with hosting
On our hosting, mailboxes on your domain are part of the plan, and mail records are set up in the Plesk panel.
Keep domain records on reliable DNS
Host MX, SPF, DKIM and DMARC on our name servers: you edit records yourself at any time, the domain can stay with any registrar and mail with any provider.