DKIM checker
Find the DKIM keys a domain publishes, even when you do not know the selector, and see whether each one is strong enough.
Results for google.com
Key found, with a warning
Only revoked keys found
p= is empty: this key has been revoked on purpose. Mail signed with this selector fails DKIM. That is fine for a retired selector, a problem if you still sign with it.
1 key: 0 fine, 0 with a problem.
Keys1
Selector 20230601
Revoked 20230601._domainkey.google.com
- Key
- Revoked (empty key)
- p= is empty: this key has been revoked on purpose. Mail signed with this selector fails DKIM. That is fine for a retired selector, a problem if you still sign with it.
What we tried1
The selector you asked about.
| Selector | Result |
|---|---|
20230601 | Key found |
Structured result (JSON) · 1.1 KB
{
"domain": "google.com",
"mode": "selector",
"status": "warning",
"found": [
{
"selector": "20230601",
"fqdn": "20230601._domainkey.google.com",
"cnameChain": [],
"tags": [
{
"name": "v",
"value": "DKIM1"
},
{
"name": "k",
"value": "rsa"
},
{
"name": "p",
"value": ""
}
],
"testing": false,
"hashes": [],
"services": [],
"record": "v=DKIM1; k=rsa; p=",
"status": "revoked",
"keyType": "revoked",
"ttl": 3600,
"issues": [
{
"severity": "warning",
"code": "REVOKED",
"message": "p= is empty: this key has been revoked on purpose. Mail signed with this selector fails DKIM. That is fine for a retired selector, a problem if you still sign with it.",
"tag": "p"
}
]
}
],
"discovery": {
"tried": [
"20230601"
],
"cap": 24,
"domainkeyExists": null,
"conclusive": true,
"errors": 0
},
"issues": [],
"notes": [],
"dnsQueries": 1,
"ttl": 3600
}What the DKIM checker does
DKIM lets a mail server sign each message with a private key. The matching public key sits in your DNS, and the receiving server fetches it to prove the message really came from your domain and was not changed on the way. This checker reads that public key and tells you if it is usable.
Enter a domain and, if you have it, a selector. The selector is the name of the key, and it is the s= value in the DKIM-Signature header of any message you sent. The key lives at <selector>._domainkey.<domain>. For the selector google on example.com that is google._domainkey.example.com.
The checker reads every tag in the record, follows a CNAME if your provider manages the key for you, decodes the key itself and reports its type and length. It flags short RSA keys, a revoked key, testing mode, a SHA-1 only key and records that are cut short or mistyped.
What happens when you do not know the selector
A domain can publish any number of selectors with any names, and DNS gives no way to list them. So no tool can promise to find every key. What we can do is try the names that mail providers document and that people use by default: google, selector1, selector2, k1, s1, default and a few more.
- We try at most 24 names, and the result lists every one we tried.
- The mail servers of the domain tell us who hosts its mail, so that provider's selectors go first.
- If the name
_domainkey.<domain>does not exist in DNS at all, no selector can exist below it, and we say so after a few quick checks. - If nothing turns up, the result says "none found" and explains that this is not proof. It never says the domain has no DKIM unless DNS shows it.
Reading a DKIM result
| Tag | Meaning | Example |
|---|---|---|
v | Version. Optional, but if it is there it must come first and read DKIM1. | v=DKIM1 |
k | Key type: rsa (the default) or ed25519. | k=rsa |
p | The public key in base64. An empty p= means the key was revoked on purpose. | p=MIIBIjAN... |
h | Hash algorithms the key accepts. sha1 alone is not allowed any more. | h=sha256 |
s | Services the key is for. * or email are the normal values. | s=email |
t | Flags. y means testing, s means the key is only for this exact domain. | t=y |
n | A note for humans. Receivers ignore it. | n=rotated 2026-01 |
Key length matters. RFC 8301 says RSA keys under 1024 bits are not acceptable, so mail signed with one fails. A 1024 bit key still works but is on its way out, and 2048 bits is the size to publish. Longer than 2048 bits rarely helps and can make the DNS record too big for some resolvers.
Many services publish the key for you. A CNAME from selector1._domainkey.example.com to a name at onmicrosoft.com means Microsoft 365 owns the key and rotates it. The result shows the CNAME, names the provider when it knows it, and tells you if the target has no key behind it, which breaks DKIM.
Fixing what the checker finds
- No key at your selectorThe record is not published at exactly that name, or the selector in the header is spelled differently. Compare the
s=value with the name in your DNS panel, and check that the zone you edited is the one that answers for the domain. - Key too shortGenerate a 2048 bit key in your mail platform, publish it under a new selector, switch signing to the new selector, and remove the old record after a few weeks.
- Testing mode is onRemove
t=yonce signatures verify. Some receivers distrust a domain that stays in testing. - Record brokenA long key is split into several quoted strings in DNS. If one piece is missing or a stray space came in, the key cannot be read. Republish the whole record.
DKIM is one of three checks mailbox providers combine. Check the others with the SPF record checker and the DMARC checker. If your mail still lands in spam after all three pass, check whether your sending address appears on a blocklist.
Questions people ask
What is a DKIM selector?
The selector is the name of one DKIM key. A domain can have many keys, for example one per mail service, and each has its own selector. The selector is part of the DNS name where the key is published and appears as s= in the DKIM-Signature header of every signed message.
Why does the checker say none found when my domain uses DKIM?
DKIM selectors cannot be listed, so the checker only tries a short set of common names. If your mail platform uses another name, enter it yourself. Find it in the s= part of the DKIM-Signature header of a message you sent.
How long should a DKIM key be?
Use 2048 bit RSA. A 1024 bit key still verifies but is considered weak, and keys under 1024 bits are rejected by RFC 8301. Ed25519 keys are small and strong, though not every receiver supports them yet, so most senders publish RSA.
What does an empty p= mean?
An empty p= tag revokes the key. Receivers treat any signature made with it as failed. That is the right way to retire a selector, and the wrong thing to see on a selector your mail platform still uses.
Do I need DKIM if I already have SPF?
Yes. SPF checks the sending server and breaks when mail is forwarded. DKIM travels with the message and survives forwarding. Gmail, Yahoo and Microsoft expect bulk senders to have both, and DMARC passes when either one lines up with your From domain.
What does t=y mean in a DKIM record?
It marks the domain as testing DKIM. Receivers are asked not to treat failures more harshly than unsigned mail, but some give signatures less weight. Remove it when you are happy that signing works.
Why is my DKIM record a CNAME?
Services such as Microsoft 365, Amazon SES and many newsletter platforms keep the key on their own DNS and ask you to point your selector at it. That lets them rotate keys without asking you. The checker follows the CNAME and reads the key at the end.
Use it from AI, the API or the command line
Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is dkim_check. Please be kind to the rate limits.
curl "https://lookupowl.com/api/v1/tools/dkim-checker?q=github.com"claude mcp add --transport http lookupowl https://lookupowl.com/mcp