DKIM checker
Find the DKIM keys a domain publishes, even when you do not know the selector, and see whether each one is strong enough.
Results for github.com
Problem found
1 of 8 keys has a problem
selector2._domainkey.github.com is a CNAME to selector2-github-com._domainkey.microsoft.onmicrosoft.com, which has no TXT record. The delegated key is missing at the provider, so DKIM fails.
8 keys: 5 fine, 1 with a problem.
Rotate to 2048 bits.
The list is short: not every selector is covered.
- Found by trying 24 common selectors. The domain may publish others: the s= value in a DKIM-Signature header is the sure way to know which one a message used.
- The MX records point at Microsoft 365, so its selectors were tried first.
Keys8
Selector selector1
Warning selector1._domainkey.github.com
- Key
- RSA, 1024 bits
- Provider
- Microsoft 365
- Delegated by CNAME to
selector1-github-com._domainkey.microsoft.onmicrosoft.com
- The RSA key is 1024 bits. RFC 8301 still allows it for verifiers but says signers should use at least 2048 bits, and large receivers may soon distrust it. Rotate to 2048 bits.
- The key is delegated by CNAME to selector1-github-com._domainkey.microsoft.onmicrosoft.com (Microsoft 365). The provider owns the key and rotates it; you only keep the CNAME.
Selector selector2
Problem selector2._domainkey.github.com
- Key
- No usable key
- Provider
- Microsoft 365
- Delegated by CNAME to
selector2-github-com._domainkey.microsoft.onmicrosoft.com
- selector2._domainkey.github.com is a CNAME to selector2-github-com._domainkey.microsoft.onmicrosoft.com, which has no TXT record. The delegated key is missing at the provider, so DKIM fails.
Selector google
Looks good google._domainkey.github.com
- Key
- RSA, 2048 bits
- Provider
- Google Workspace
Selector k1
Warning k1._domainkey.github.com
- Key
- RSA, 1024 bits
- Provider
- Mailchimp
- Delegated by CNAME to
dkim.mcsv.net
- The RSA key is 1024 bits. RFC 8301 still allows it for verifiers but says signers should use at least 2048 bits, and large receivers may soon distrust it. Rotate to 2048 bits.
- The key is delegated by CNAME to dkim.mcsv.net (Mailchimp). The provider owns the key and rotates it; you only keep the CNAME.
Selector k2
Looks good k2._domainkey.github.com
- Key
- RSA, 2048 bits
- Delegated by CNAME to
dkim2.mcsv.net
- The key is delegated by CNAME to dkim2.mcsv.net. The provider owns the key and rotates it; you only keep the CNAME.
Selector k3
Looks good k3._domainkey.github.com
- Key
- RSA, 2048 bits
- Delegated by CNAME to
dkim3.mcsv.net
- The key is delegated by CNAME to dkim3.mcsv.net. The provider owns the key and rotates it; you only keep the CNAME.
Selector s1
Looks good s1._domainkey.github.com
- Key
- RSA, 2048 bits
- Provider
- SendGrid
- Delegated by CNAME to
s1.domainkey.u51742174.wl175.sendgrid.net
- t=s means this key is only for mail from exactly this domain, not its subdomains.
- The key is delegated by CNAME to s1.domainkey.u51742174.wl175.sendgrid.net (SendGrid). The provider owns the key and rotates it; you only keep the CNAME.
Selector s2
Looks good s2._domainkey.github.com
- Key
- RSA, 2048 bits
- Provider
- SendGrid
- Delegated by CNAME to
s2.domainkey.u51742174.wl175.sendgrid.net
- t=s means this key is only for mail from exactly this domain, not its subdomains.
- The key is delegated by CNAME to s2.domainkey.u51742174.wl175.sendgrid.net (SendGrid). The provider owns the key and rotates it; you only keep the CNAME.
What we tried24
DKIM selectors cannot be listed, so these 24 names are the common ones, tried in this order. A name that is not here is not ruled out.
| Selector | Result |
|---|---|
selector1 | Key found |
selector2 | Key found |
google | Key found |
k1 | Key found |
k2 | Key found |
k3 | Key found |
s1 | Key found |
s2 | Key found |
default | Nothing there |
dkim | Nothing there |
mail | Nothing there |
mxvault | Nothing there |
fm1 | Nothing there |
fm2 | Nothing there |
fm3 | Nothing there |
protonmail | Nothing there |
protonmail2 | Nothing there |
protonmail3 | Nothing there |
zoho | Nothing there |
zmail | Nothing there |
sig1 | Nothing there |
pm | Nothing there |
mandrill | Nothing there |
smtp | Nothing there |
Structured result (JSON) · 11 KB
{
"domain": "github.com",
"mode": "discovery",
"status": "error",
"found": [
{
"selector": "selector1",
"fqdn": "selector1._domainkey.github.com",
"cnameChain": [
"selector1-github-com._domainkey.microsoft.onmicrosoft.com"
],
"provider": "Microsoft 365",
"tags": [
{
"name": "v",
"value": "DKIM1"
},
{
"name": "k",
"value": "rsa"
},
{
"name": "p",
"value": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxZC/z2cK+2s1f/ktzSDSeFzkfIHrjwtGFsfKMAYvKaXjPVNzKykpbXBkX5nB7dVUTFttda7aROr2iSrIs…"
}
],
"testing": false,
"hashes": [],
"services": [],
"record": "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxZC/z2cK+2s1f/ktzSDSeFzkfIHrjwtGFsfKMAYvKaXjPVNzKykpbXBkX5nB7dVUTFttda7aROr2iSrIseQ27Ui+4rUZVzgFanE8RaXhYM9n5wPKNv8GtLJk7JgcsYZ7ErgID4uW2sEYyV/dnRYw6rDzOaeRKkKELTUfJI5ebLQIDAQAB;",
"status": "warning",
"keyType": "rsa",
"keyBits": 1024,
"ttl": 3600,
"issues": [
{
"severity": "warning",
"code": "SHORT_KEY",
"message": "The RSA key is 1024 bits. RFC 8301 still allows it for verifiers but says signers should use at least 2048 bits, and large receivers may soon distrust it. Rotate to 2048 bits.",
"tag": "p"
},
{
"severity": "info",
"code": "CNAME_DELEGATION",
"message": "The key is delegated by CNAME to selector1-github-com._domainkey.microsoft.onmicrosoft.com (Microsoft 365). The provider owns the key and rotates it; you only keep the CNAME."
}
]
},
{
"selector": "selector2",
"fqdn": "selector2._domainkey.github.com",
"cnameChain": [
"selector2-github-com._domainkey.microsoft.onmicrosoft.com"
],
"provider": "Microsoft 365",
"tags": [],
"testing": false,
"hashes": [],
"services": [],
"status": "error",
"keyType": "unknown",
"issues": [
{
"severity": "error",
"code": "DANGLING_CNAME",
"message": "selector2._domainkey.github.com is a CNAME to selector2-github-com._domainkey.microsoft.onmicrosoft.com, which has no TXT record. The delegated key is missing at the provider, so DKIM fails."
}
]
},
{
"selector": "google",
"fqdn": "google._domainkey.github.com",
"cnameChain": [],
"provider": "Google Workspace",
"tags": [
{
"name": "v",
"value": "DKIM1"
},
{
"name": "k",
"value": "rsa"
},
{
"name": "p",
"value": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj6T5sl/RwdSqGoYWaWaFbS2UAeyPrEmd0gogocmRfS441qwR8/0KB81Hw89P0l4YiFRrXYk7NVIG…"
}
],
"testing": false,
"hashes": [],
"services": [],
"record": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj6T5sl/RwdSqGoYWaWaFbS2UAeyPrEmd0gogocmRfS441qwR8/0KB81Hw89P0l4YiFRrXYk7NVIGfyCRHAYYZUzCkGeOysI2EjgzLFhd/NEsbRzOEc/kWkK/RO6JFq/5lOn6M9AZw/ap9tds4JG9ApgNNdSpPxp9DmvpsOSgNMVflRxQFrk3kdS4RNAPKu/OPoA7dlR/A/pECryjRoYgENtDXzdnK70HgCekems6UDzxDj61cjyoKoXtEMF/QsaHEQ1Gjfv014rDJBsubk/kT5VqHkWHa/ia68Z5r228Ety/wFfQNjXTx/J7KGZ9GkZlKED659eiJcLnWcKDSiQlhwIDAQAB",
"status": "ok",
"keyType": "rsa",
"keyBits": 2048,
"ttl": 3600,
"issues": []
},
{
"selector": "k1",
"fqdn": "k1._domainkey.github.com",
"cnameChain": [
"dkim.mcsv.net"
],
"provider": "Mailchimp",
"tags": [
{
"name": "k",
"value": "rsa"
},
{
"name": "p",
"value": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i89sA2guU0ta4UX1Xzm06XIU6iBP41VwmPwBGRNof…"
}
],
"testing": false,
"hashes": [],
"services": [],
"record": "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i89sA2guU0ta4UX1Xzm06XIU6iBP41VwmPwBGRNofhBVR+e6WHUoNyIR4Bn84LVcfZE20rmDeXQblIupNWBqLXM1Q+VieI/eZu/7k9/vOkLSaQQdml4Cv8lb3PcnluMVIhQIDAQAB;",
"status": "warning",
"keyType": "rsa",
"keyBits": 1024,
"ttl": 86400,
"issues": [
{
"severity": "warning",
"code": "SHORT_KEY",
"message": "The RSA key is 1024 bits. RFC 8301 still allows it for verifiers but says signers should use at least 2048 bits, and large receivers may soon distrust it. Rotate to 2048 bits.",
"tag": "p"
},
{
"severity": "info",
"code": "CNAME_DELEGATION",
"message": "The key is delegated by CNAME to dkim.mcsv.net (Mailchimp). The provider owns the key and rotates it; you only keep the CNAME."
}
]
},
{
"selector": "k2",
"fqdn": "k2._domainkey.github.com",
"cnameChain": [
"dkim2.mcsv.net"
],
"tags": [
{
"name": "v",
"value": "DKIM1"
},
{
"name": "k",
"value": "rsa"
},
{
"name": "p",
"value": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2aC2KjGKLOwTweBY5A9RpjsxaBXR9r7OAU6U8/zn92ivImI75naUujWbItRI/QmL1jy5PWGqLwo…"
}
],
"testing": false,
"hashes": [],
"services": [],
"record": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2aC2KjGKLOwTweBY5A9RpjsxaBXR9r7OAU6U8/zn92ivImI75naUujWbItRI/QmL1jy5PWGqLwoUA0b90ObWaLDc+i9MtTNmGeWO009hr20fIxhGg6XBT2kjZ1DTThopSe1nAndsupmcBwlQ5Q6LJ+ZAxLcujnPIxM0ZBLmgpkv8u6RfY4eFP8OLvdAW3oSuB0DyLDigQX4Sj8wBO4YIdQH6AAmBeOsidsKAFNFUCpc3vCxtBDR12U+cBg724l3sBkMQ8evnz6idnqxq9QAVYh8k4kJ+RP+6cqTdy7LjIm8xY/bQNpQIpGUAuDo2DjLcCDun9DAI4Q/3z+Q0o9QuQIDAQAB;",
"status": "ok",
"keyType": "rsa",
"keyBits": 2048,
"ttl": 14400,
"issues": [
{
"severity": "info",
"code": "CNAME_DELEGATION",
"message": "The key is delegated by CNAME to dkim2.mcsv.net. The provider owns the key and rotates it; you only keep the CNAME."
}
]
},
{
"selector": "k3",
"fqdn": "k3._domainkey.github.com",
"cnameChain": [
"dkim3.mcsv.net"
],
"tags": [
{
"name": "v",
"value": "DKIM1"
},
{
"name": "k",
"value": "rsa"
},
{
"name": "p",
"value": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsYGiMSn7fsUqSvfSX40x9R1OlRtbNiCY80lHRIlcKx3XDIR7257aUx+q9CSIARdfTL6KCuLGNFx5…"
}
],
"testing": false,
"hashes": [],
"services": [],
"record": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsYGiMSn7fsUqSvfSX40x9R1OlRtbNiCY80lHRIlcKx3XDIR7257aUx+q9CSIARdfTL6KCuLGNFx5g9TgVr6png4ajcieSQGtOehBgxnkDN8aAA5TX0FmFrcefJU0JoxLOF09EKgXxhSSHCk/ekVb0PXSboHXoZ9+EI404F1qhcwXXIgHXTaUthHTut2P6BBZhIXIgvDe/w49GchR7MRJqjNb7neEBbYHbgWuBTvvHCg7Gy6m6n9krYK+ROWq3dVvXy9plAGK3ygM+HtjIiMt7arRGMOF0WgDTz7YdN9BGpt6BvXxLnjiQcgS5T9n+cIyPZgiWzDMXNlaEEdKTEKxrwIDAQAB;",
"status": "ok",
"keyType": "rsa",
"keyBits": 2048,
"ttl": 14400,
"issues": [
{
"severity": "info",
"code": "CNAME_DELEGATION",
"message": "The key is delegated by CNAME to dkim3.mcsv.net. The provider owns the key and rotates it; you only keep the CNAME."
}
]
},
{
"selector": "s1",
"fqdn": "s1._domainkey.github.com",
"cnameChain": [
"s1.domainkey.u51742174.wl175.sendgrid.net"
],
"provider": "SendGrid",
"tags": [
{
"name": "k",
"value": "rsa"
},
{
"name": "t",
"value": "s"
},
{
"name": "p",
"value": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyn3fMCVpb7ryIRKOGXhXVGYmsWUitNlSckqGHOwNFZgFadplOrD+Qzf1XQkP7MH/VB/97DsAAJGt…"
}
],
"testing": false,
"hashes": [],
"services": [],
"record": "k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyn3fMCVpb7ryIRKOGXhXVGYmsWUitNlSckqGHOwNFZgFadplOrD+Qzf1XQkP7MH/VB/97DsAAJGtEXW1Uq71Hjnfr/DuBN/YfjF/gU70qEFb7q1sdIiNtjFL2TkOpoW+X/bhhPNheW/fYwyFb6ZHFM6LTgXyuimWRHTOUP3VjZzhNVda79nt+2WZYbS4l8HdMgWpTNHjpVw5PtXESA9KBg/evSRk5fIaXIX5eRXW3baoV9yVzD8O29/IL/DiSk+yNvaO0EHL5c4yGuZJhGzvpiznb2IDVdemJK4Dqzdy5FTN/SGYZhAEr7MguG3Z314hMS2scgMsOMgB64uj/6+6UwIDAQAB",
"status": "ok",
"keyType": "rsa",
"keyBits": 2048,
"ttl": 1800,
"issues": [
{
"severity": "info",
"code": "STRICT_SUBDOMAINS",
"message": "t=s means this key is only for mail from exactly this domain, not its subdomains.",
"tag": "t"
},
{
"severity": "info",
"code": "CNAME_DELEGATION",
"message": "The key is delegated by CNAME to s1.domainkey.u51742174.wl175.sendgrid.net (SendGrid). The provider owns the key and rotates it; you only keep the CNAME."
}
]
},
{
"selector": "s2",
"fqdn": "s2._domainkey.github.com",
"cnameChain": [
"s2.domainkey.u51742174.wl175.sendgrid.net"
],
"provider": "SendGrid",
"tags": [
{
"name": "k",
"value": "rsa"
},
{
"name": "t",
"value": "s"
},
{
"name": "p",
"value": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNt2/H6bKs99C6DAaokPp62KN9mKaD20D1PBakkObejkJvzM6Un/fKHPeI2/qXdvFFBPQE3mxMNo…"
}
],
"testing": false,
"hashes": [],
"services": [],
"record": "k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNt2/H6bKs99C6DAaokPp62KN9mKaD20D1PBakkObejkJvzM6Un/fKHPeI2/qXdvFFBPQE3mxMNoe+hwBVDgMgCuZEn8J6gZYI4amITure9/ny6+GaNVRoH2m6xAtWwKINkKxMayGiehkWlRVb7D23F0U8y+VDHKQFz1bnXA5jDpcDiMXy8i2lV5vEys+qt+1WGhDKCAwamT8c3xkZz8aXMJaXYCiN2HMgHDU81+mVCk4+u6mY+a98APVfFhsQ0KCq/mVZXaXTV06QrG9M5PtBHUFW7VtwXKp+AFrAut0KW1NnwaA5IGA5sc+n9dma7bSqdfGS+ixdSmJ69NwmYSHwIDAQAB",
"status": "ok",
"keyType": "rsa",
"keyBits": 2048,
"ttl": 1800,
"issues": [
{
"severity": "info",
"code": "STRICT_SUBDOMAINS",
"message": "t=s means this key is only for mail from exactly this domain, not its subdomains.",
"tag": "t"
},
{
"severity": "info",
"code": "CNAME_DELEGATION",
"message": "The key is delegated by CNAME to s2.domainkey.u51742174.wl175.sendgrid.net (SendGrid). The provider owns the key and rotates it; you only keep the CNAME."
}
]
}
],
"discovery": {
"tried": [
"selector1",
"selector2",
"google",
"k1",
"k2",
"k3",
"s1",
"s2",
"default",
"dkim",
"mail",
"mxvault",
"fm1",
"fm2",
"fm3",
"protonmail",
"protonmail2",
"protonmail3",
"zoho",
"zmail",
"sig1",
"pm",
"mandrill",
"smtp"
],
"cap": 24,
"domainkeyExists": true,
"conclusive": false,
"errors": 0,
"mxHint": "Microsoft 365"
},
"issues": [],
"notes": [
"Found by trying 24 common selectors. The domain may publish others: the s= value in a DKIM-Signature header is the sure way to know which one a message used.",
"The MX records point at Microsoft 365, so its selectors were tried first."
],
"dnsQueries": 27,
"ttl": 1800
}What the DKIM checker does
DKIM lets a mail server sign each message with a private key. The matching public key sits in your DNS, and the receiving server fetches it to prove the message really came from your domain and was not changed on the way. This checker reads that public key and tells you if it is usable.
Enter a domain and, if you have it, a selector. The selector is the name of the key, and it is the s= value in the DKIM-Signature header of any message you sent. The key lives at <selector>._domainkey.<domain>. For the selector google on example.com that is google._domainkey.example.com.
The checker reads every tag in the record, follows a CNAME if your provider manages the key for you, decodes the key itself and reports its type and length. It flags short RSA keys, a revoked key, testing mode, a SHA-1 only key and records that are cut short or mistyped.
What happens when you do not know the selector
A domain can publish any number of selectors with any names, and DNS gives no way to list them. So no tool can promise to find every key. What we can do is try the names that mail providers document and that people use by default: google, selector1, selector2, k1, s1, default and a few more.
- We try at most 24 names, and the result lists every one we tried.
- The mail servers of the domain tell us who hosts its mail, so that provider's selectors go first.
- If the name
_domainkey.<domain>does not exist in DNS at all, no selector can exist below it, and we say so after a few quick checks. - If nothing turns up, the result says "none found" and explains that this is not proof. It never says the domain has no DKIM unless DNS shows it.
Reading a DKIM result
| Tag | Meaning | Example |
|---|---|---|
v | Version. Optional, but if it is there it must come first and read DKIM1. | v=DKIM1 |
k | Key type: rsa (the default) or ed25519. | k=rsa |
p | The public key in base64. An empty p= means the key was revoked on purpose. | p=MIIBIjAN... |
h | Hash algorithms the key accepts. sha1 alone is not allowed any more. | h=sha256 |
s | Services the key is for. * or email are the normal values. | s=email |
t | Flags. y means testing, s means the key is only for this exact domain. | t=y |
n | A note for humans. Receivers ignore it. | n=rotated 2026-01 |
Key length matters. RFC 8301 says RSA keys under 1024 bits are not acceptable, so mail signed with one fails. A 1024 bit key still works but is on its way out, and 2048 bits is the size to publish. Longer than 2048 bits rarely helps and can make the DNS record too big for some resolvers.
Many services publish the key for you. A CNAME from selector1._domainkey.example.com to a name at onmicrosoft.com means Microsoft 365 owns the key and rotates it. The result shows the CNAME, names the provider when it knows it, and tells you if the target has no key behind it, which breaks DKIM.
Fixing what the checker finds
- No key at your selectorThe record is not published at exactly that name, or the selector in the header is spelled differently. Compare the
s=value with the name in your DNS panel, and check that the zone you edited is the one that answers for the domain. - Key too shortGenerate a 2048 bit key in your mail platform, publish it under a new selector, switch signing to the new selector, and remove the old record after a few weeks.
- Testing mode is onRemove
t=yonce signatures verify. Some receivers distrust a domain that stays in testing. - Record brokenA long key is split into several quoted strings in DNS. If one piece is missing or a stray space came in, the key cannot be read. Republish the whole record.
DKIM is one of three checks mailbox providers combine. Check the others with the SPF record checker and the DMARC checker. If your mail still lands in spam after all three pass, check whether your sending address appears on a blocklist.
Questions people ask
What is a DKIM selector?
The selector is the name of one DKIM key. A domain can have many keys, for example one per mail service, and each has its own selector. The selector is part of the DNS name where the key is published and appears as s= in the DKIM-Signature header of every signed message.
Why does the checker say none found when my domain uses DKIM?
DKIM selectors cannot be listed, so the checker only tries a short set of common names. If your mail platform uses another name, enter it yourself. Find it in the s= part of the DKIM-Signature header of a message you sent.
How long should a DKIM key be?
Use 2048 bit RSA. A 1024 bit key still verifies but is considered weak, and keys under 1024 bits are rejected by RFC 8301. Ed25519 keys are small and strong, though not every receiver supports them yet, so most senders publish RSA.
What does an empty p= mean?
An empty p= tag revokes the key. Receivers treat any signature made with it as failed. That is the right way to retire a selector, and the wrong thing to see on a selector your mail platform still uses.
Do I need DKIM if I already have SPF?
Yes. SPF checks the sending server and breaks when mail is forwarded. DKIM travels with the message and survives forwarding. Gmail, Yahoo and Microsoft expect bulk senders to have both, and DMARC passes when either one lines up with your From domain.
What does t=y mean in a DKIM record?
It marks the domain as testing DKIM. Receivers are asked not to treat failures more harshly than unsigned mail, but some give signatures less weight. Remove it when you are happy that signing works.
Why is my DKIM record a CNAME?
Services such as Microsoft 365, Amazon SES and many newsletter platforms keep the key on their own DNS and ask you to point your selector at it. That lets them rotate keys without asking you. The checker follows the CNAME and reads the key at the end.
Use it from AI, the API or the command line
Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is dkim_check. Please be kind to the rate limits.
curl "https://lookupowl.com/api/v1/tools/dkim-checker?q=github.com"claude mcp add --transport http lookupowl https://lookupowl.com/mcp