DKIM record checker
Look up a domain's DKIM public key by selector, or let us try the common ones, and check the key's type and length.
A domain, an email address or a URL. Lookups go from your browser to Cloudflare's public DNS (1.1.1.1); nothing is sent to simmail.
What a DKIM record is
DKIM (DomainKeys Identified Mail, RFC 6376) lets a sending server sign each message with a private key. The matching public key is published in DNS as a TXT record at <selector>._domainkey.<domain>. A receiver reads the d= (domain) and s= (selector) from the message's DKIM-Signature header, fetches the key, and checks that the signed headers and body haven't changed in transit.
The key record has a few tags: v=DKIM1 (version), k (key type, rsa by default or ed25519), p (the public key, base64), and optionally h (allowed hash algorithms), t (flags such as y for testing) and s (service type). This checker decodes the key itself to report its real length rather than guessing from the record size.
Why it matters
DKIM is the authentication that survives forwarding, and one of the two ways a message can pass DMARC (the d= domain must align with the From domain). Since February 2024, Gmail and Yahoo require bulk senders to sign with DKIM, alongside SPF and DMARC. A missing, revoked or mistyped key means every signature fails.
Common mistakes
- The key pasted incompletely. 2048-bit keys are longer than 255 characters, so they are split into several strings. Some DNS panels cut the key off or add quotes inside it, and the key no longer decodes.
- Signing with your provider's domain. If
d=is the provider's domain rather than yours, DKIM passes but doesn't align for DMARC. Set up a custom DKIM domain at your provider. - Short keys. Keys under 1024 bits are rejected; 1024 works but 2048 is recommended (RFC 8301).
- Testing mode left on.
t=yasks receivers to treat signatures as unverified. - SHA-1.
h=sha1restricts the key to an algorithm RFC 8301 forbids. - CNAME records not created. Microsoft 365 and many sending services publish keys behind CNAMEs (for example
selector1._domainkey). If the CNAME is missing, so is the key.
Questions
How do I find my DKIM selector?
Open a message you sent, view its original source, and find the DKIM-Signature header. The s= value is the selector and d= is the domain. Our header analyzer pulls both out for you.
Why didn't the common-selector search find my key?
Selectors can be any name, and DNS has no way to list them. We try a list of names that providers often use; if yours is different, enter it in the selector box.
Is a 1024-bit key still OK?
It is accepted everywhere, but RFC 8301 recommends at least 2048 bits, and keys below 1024 bits must be rejected by receivers. Rotate to 2048 bits when you can.
What does an empty p= mean?
The key has been revoked (RFC 6376). Signatures using that selector will fail. That is normal for a retired selector, and a problem if you still sign with it.
What about Ed25519 keys?
RFC 8463 added Ed25519 for DKIM. Keys are much shorter, but not every receiver verifies them yet, so sign with an RSA key too, under a second selector.
Your DNS is right. Now see how real people react to your email
simmail sends your app's mail to simulated people who open, ignore, junk, click and reply, so you can test what happens after delivery. Start free, no card.