Patchkit

Free tool

DKIM Checker

Find the DKIM keys a domain publishes, check their strength, and catch revoked or test-mode keys. Enter your selector if you know it.

What DKIM proves

DKIM adds a cryptographic signature to every message. Receivers fetch your public key from DNS and verify that the message wasn't changed in transit and really came from a server holding your private key. Because the signature survives forwarding, DKIM is usually what carries DMARC for newsletters and help-desk tools.

Key length and rotation

Use 2048-bit RSA keys. Keep the old selector published for a few days after switching to a new one, so messages already in transit still verify. An empty p= tag means a key was revoked on purpose.

Not sure how to set DKIM up for your provider? Pick it from the setup guides.

Frequently asked questions

+What is a DKIM selector?

A selector is a label that tells receivers where to find the public key, at selector._domainkey.yourdomain.com. Each email service picks its own, such as google for Google Workspace or selector1 for Microsoft 365. You can see it in the s= tag of a DKIM-Signature header.

+Why can't the checker find my DKIM key?

DNS doesn't let anyone list all selectors, so we probe the common ones. Services like Amazon SES and Postmark use random or date-based selectors. Open a message you sent, find the DKIM-Signature header, and enter the s= value.

+Is a 1024-bit DKIM key still OK?

It still works, but 2048-bit keys are the current recommendation and most providers support them. Rotate when your provider allows it.