DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. The matching public key is published in DNS, so receivers can check that the message really comes from your domain and was not changed on the way.
The key is a TXT record at selector._domainkey.yourdomain.com. The selector is a name chosen by your email provider, so you need it to look the key up.
The selector is the part of the name before ._domainkey.
| Where | What to do |
|---|---|
| In an email header | Open an email you sent, view its source and find the DKIM-Signature line. The value after s= is the selector. |
| In your email provider | Providers show the selector where you set up DKIM. Common ones are google, selector1 and selector2. |
| Leave it empty | This tool then tries a list of common selectors. It cannot find every selector, because a selector can have any name. |
The main points of a DKIM record.
Quick answers about DKIM Check.
A name that lets a domain publish several DKIM keys at once. It forms the DNS name selector._domainkey.yourdomain.com.
The name may have a typo, the record may not be published yet, or your DNS panel may have changed it. Look at the DKIM-Signature header of an email you sent to confirm the selector.
2048 bits is the recommended size for RSA keys. Many providers split long keys into several quoted strings inside one TXT record, which is normal.
Yes. Providers and rotating keys often use different selectors at the same time.
No. DKIM proves a message was signed, but receivers need DMARC to know what to do when it fails. See DMARC Check.
Other checks you may find useful.