DKIM checker

What DKIM is

DKIM adds a digital signature to every email you send. The receiver looks up your public key in DNS and checks the signature. If it matches, they know the email came from a service you approved and wasn't changed on the way.

DKIM is the most reliable way to pass DMARC, because unlike SPF it survives forwarding.

Finding your selector

DKIM keys live at selector._domainkey.yourdomain.com. The selector is a name chosen by the sending service. Common ones:

The checker tries these automatically. To find the selector for certain, open an email you sent, view the original message, and look for s= in the DKIM-Signature header.

Key length

Keys should be at least 1024 bits, and 2048 bits is recommended. Older 512-bit keys can be cracked and are rejected by many receivers. Most services let you rotate to a 2048-bit key from their settings page.

Fixing DKIM problems

• No key found: switch on DKIM in the sending service and publish the records it gives you. In Microsoft 365 this is in Defender, under email authentication settings.
• Key found but email fails: the service may be signing with its own domain rather than yours. Look for "custom domain" or "domain authentication".
• Short key: rotate to 2048 bits.

Once DKIM passes, check that your DMARC is set up so that receivers act on it.