DKIM (DomainKeys Identified Mail, RFC 6376) adds a cryptographic signature to every message you send. The sending platform signs selected headers and the body with a private key, and receivers verify that signature using a public key you publish in DNS. A pass proves the message came from a system you authorised and was not altered on the way.
The public key lives at a hostname made from a selector and your domain:
selector._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."This checker fetches that record and tells you whether it will actually work.
What the checker does
- With a selector: looks up that exact record, following a CNAME if your provider delegates the key.
- Without a selector: tries 25 common selectors, including
default,google,selector1,selector2,k1,k2,k3,s1,s2,sign,mail,dkim,pm,mandrillandmailjet, and reports every one it finds. - Parses each tag and reports the key type (RSA or Ed25519).
- Calculates the RSA key length and grades it: 2048 bits or more is recommended, 1024 bits gets a warning.
- Flags a revoked key (empty
p=) and test mode (t=y).
Common selectors by provider
If the automatic scan finds nothing, this table tells you where to look.
| Provider | Typical selector(s) | Notes |
|---|---|---|
| Google Workspace | google |
Generated in the Admin console under Gmail authentication |
| Microsoft 365 | selector1, selector2 |
Published as CNAMEs pointing to your tenant’s onmicrosoft.com domain |
| Mailchimp | k1, k2, k3 |
CNAMEs to Mailchimp-managed keys |
| SendGrid | s1, s2 |
CNAMEs created during domain authentication |
| SendPulse | sign |
TXT record shown in the sender domain settings |
| Postmark | pm or date-based, like 20240112pm |
Newer accounts use date-stamped selectors |
| Amazon SES | Three random tokens | Easy DKIM publishes three CNAMEs with 32-character selectors |
| Brevo | mail |
Shown in the Brevo domain authentication page |
| Mailjet | mailjet |
TXT record from account settings |
| Mandrill (Mailchimp Transactional) | mandrill |
TXT record from sending domains |
When in doubt, the s= value in a real DKIM-Signature header is the only authoritative answer.
DKIM tags explained
| Tag | Meaning | Good value |
|---|---|---|
v= |
Version | DKIM1 (optional, but if present must be first) |
k= |
Key type | rsa (default) or ed25519 |
p= |
Public key, base64 encoded | Present and complete. Empty means revoked |
t= |
Flags | Absent in production. y means testing, s restricts subdomains |
h= |
Acceptable hash algorithms | Absent or sha256 |
s= |
Service type | Absent or email |
How to read your results
Key found, RSA 2048. Healthy. Confirm live mail passes by sending yourself a message and checking the header.
Key found, RSA 1024. Works, but rotate up. Some DNS panels struggle with long 2048-bit keys, so the fix may be splitting the key into two quoted strings.
Key found, t=y. Receivers may treat failures leniently because you declared you are still testing. Remove the flag once signing is stable.
Revoked key. The selector exists with an empty p=. Fine for a retired selector, a problem if it is still in use.
No key found. Either DKIM is not set up, the selector is different from the ones tried, or DNS has not propagated. Check a message header for the real selector.
Common problems and fixes
Truncated key. A single TXT string holds at most 255 characters. A 2048-bit key is longer, so it must be split into several quoted strings in one record. If your DNS panel saves only the first chunk, the key is broken. Paste the record as two quoted strings, or use a CNAME if the provider offers one.
Stray characters. Copying from a web page can add line breaks, spaces or a doubled v=DKIM1. The checker’s parser will show a malformed key.
Wrong hostname. Some DNS panels append your domain automatically, so entering s1._domainkey.example.com creates s1._domainkey.example.com.example.com. Enter only s1._domainkey.
Signature valid, DMARC fails. The mail is signed with the ESP’s domain (for example d=esp-mail.net) rather than yours. Enable custom DKIM on your own domain so d= aligns with the From address.
Body hash mismatch. A security gateway, mailing list or disclaimer tool changed the message after signing. Move the modification before signing, or rely on ARC for forwarded paths.
Confirming DKIM on live mail
A published key is only half the test. The other half is whether your platform actually signs with it. Send a message to a Gmail or Outlook address you control, open the raw headers and look for a line like this:
Authentication-Results: mx.google.com;
dkim=pass header.i=@example.com header.s=google header.b=Xy12AbCheck three things: the result is pass, the header.s selector matches the record you checked here, and the signing domain is your domain rather than the ESP’s. The header analyzer shows all three at a glance.
Rotating keys safely
- Generate a new 2048-bit key in your sending platform under a new selector.
- Publish the new public key and confirm it resolves here.
- Switch signing to the new selector and verify a live message passes.
- Leave the old key published for a week or two for messages in transit, then revoke or delete it.
DKIM is one part of authentication
A valid signature proves integrity, but it does not tell receivers what to do with unsigned or failing mail. DMARC does that. After DKIM passes, check your DMARC record and your SPF record, and read the email authentication guide for the full setup. For an overall view of how your domain looks to receivers, run the sender reputation checker.