DKIM checker: are your emails signed?
Enter your domain and, if you know it, the selector: we look for the published DKIM key and tell you whether it exists, whether it’s valid and how long it is.
- Free, no sign-up
- Public DNS records only
- Result in seconds
Want the step-by-step fixes?We email you the full report on SPF, DKIM, DMARC and MX, with the values to copy.
Done: the report reaches your inbox in a few minutes. If you don’t see it, check spam or Promotions too.
What a DKIM signature is
DKIM adds a digital signature to every email. The receiving server fetches the public key from your DNS and checks that the email really comes from you and wasn’t changed.
The key lives in a TXT record named selector._domainkey.yourdomain. The sending service chooses the selector: for example google for Google Workspace, selector1 for Microsoft 365.
googleThe selector: the sending service chooses it.._domainkeyThe fixed part of every DKIM key name.v=DKIM1; k=rsaVersion and key type.p=MIIBIjANBgkq…The public key. If it’s empty, the signature is revoked.The problems we find most often
Signing never turned on
Many services leave it off until you turn it on and publish the record they give you.
Uncommon selector
If your service uses an unusual name we can’t find it on our own: enter it in the selector field.
Revoked key
An empty key (p=) means the signature is revoked: your emails don’t pass as signed.
Short key
Below 1024 bits the key is considered weak: regenerate it with 2048 bits.
Frequently asked questions
Where do I find my selector?
In the DKIM settings of the service you send from, or in the headers of a sent email: in the DKIM-Signature line it’s the value after s=.
The check says “to check”: is DKIM missing?
Not necessarily. We try the most common selectors; if your service uses another one, enter it in the field and check again.
Can I have several DKIM keys?
Yes. Every service that sends on your behalf can have its own selector and key: they don’t overwrite each other.
1024 or 2048 bits?
2048 bits. 1024 still works, but regenerate a longer key when you get the chance.
More free checks
SPF checker
A single record, its ending, DNS lookups under the limit of 10.
OpenDMARC checker
Policy, reports address, inherited record.
OpenMX lookup
Who receives the mail, priorities and spam filters.
Open554 5.7.1 error
Why the email was rejected and how to fix it.
OpenFull DNS check
SPF, DKIM, DMARC and MX at once, with the report by email.
OpenFree DNS check API
JSON, no key, CORS enabled.
OpenDo your website or app emails still leave from the hosting server?
SMTP Senpai is the MailSenpai SMTP relay: it signs your emails with DKIM on your own domain, gives you the DNS records to publish and checks them for you. Servers and data in the EU.