What this tool checks
DKIM adds a cryptographic signature to your outgoing email so receivers can verify it wasn't altered and really came from your domain. DKIM keys live in DNS under a named selector, so this checker probes the common selectors (default, google, selector1/2, and more) and reports which DKIM keys are published, alongside your SPF and DMARC. If you use a custom selector, your DKIM may still be valid even when it isn't auto-detected here.
Selectors, key length, and rotation
Each sending service publishes its own DKIM public key under a selector it chooses, so a domain that sends through several providers will have several selectors live at once. Keys should be 2048-bit where your provider supports it, since older 1024-bit keys are weaker. Rotating keys periodically limits the damage if one is ever exposed, and providers typically stage the new selector before switching. A key that's truncated in DNS (split incorrectly across TXT strings) or removed will silently break signing, which is exactly the kind of drift worth watching.
Frequently asked questions
What is a DKIM selector?
A selector is a label that points to a specific DKIM public key in DNS, at selector._domainkey.yourdomain.com. It lets a domain rotate keys and run multiple senders. This tool tries the selectors most providers use.
My DKIM isn't detected, is it broken?
Not necessarily. If your mail provider uses a custom selector this tool doesn't probe, your DKIM can be fully working. Check your provider's DNS instructions for the exact selector name.
How does DKIM relate to SPF and DMARC?
DKIM proves a message wasn't tampered with; SPF authorizes sending servers; DMARC ties them together and sets a policy. You want all three, which is why this tool shows them together.
Why does DKIM pass but DMARC still fail?
DMARC requires alignment, not just a valid signature. If the DKIM signing domain (the d= value) doesn't match the domain in the visible From address, DKIM passes on its own but fails DMARC alignment. Configure your provider to sign with your own domain rather than theirs to fix it.