What the DKIM checker tests
- A TXT record exists at
selector._domainkey.domain(CNAMEs are followed). v=DKIM1if present, a valid base64p=public key, and whether it is revoked.- Key type (
k=rsaored25519) and approximate RSA key length. - Testing flag
t=y.
Common selectors by provider
| Provider | Selector |
|---|---|
| Google Workspace | google (default) |
| Microsoft 365 | selector1, selector2 |
| Mailchimp | k2, k3 |
| SendGrid | s1, s2 |
| Fastmail | fm1-fm3 |
| Zoho Mail | chosen at setup (often zmail or default) |
Need a key pair? Use the DKIM generator.
Get alerted when it changes
Free daily monitoring re-checks SPF, DKIM, DMARC, MX, BIMI and MTA-STS and emails you when something changes or fails.
Set up free monitoringFrequently asked questions
How do I find my DKIM selector?
Open a message you sent, view the original headers and find the DKIM-Signature header. The s= value is the selector and d= is the signing domain. Google Workspace defaults to google, Microsoft 365 uses selector1 and selector2.
What key length should DKIM use?
2048-bit RSA. 1024-bit keys still validate but are considered weak; keys under 1024 bits should be rejected by receivers (RFC 8301).
What does an empty p= mean?
The key has been revoked. Mail signed with that selector will fail DKIM. It is normal for old, rotated selectors.