Guide
Checking DKIM keys: selectors, key sizes and revoked records
DKIM signs outgoing mail with a private key. Receivers fetch the matching public key from DNS and use it to check that the message was not altered and that the signing domain authorised it. When DKIM fails, mail is more likely to land in spam, and DMARC cannot pass through DKIM. The page fetches a key by selector and reports what it contains.
Where the key lives
The public key is published in a TXT record at selector._domainkey.example.com. The selector is a label chosen by whoever sets up the key, so a domain can have many keys at once. The record is a list of tags separated by semicolons: v=DKIM1 (version), k= (key type, rsa by default), p= (the public key in Base64), and optional tags such as t= for flags (t=y means testing mode, where failures should not be treated as errors) and h= for acceptable hash algorithms. The format is defined in RFC 6376, with Ed25519 keys added by RFC 8463.
Finding the selector
The selector is not secret and appears in every signed message. Open a message sent from the domain, view the full source and find the DKIM-Signature header; its s= value is the selector and d= is the domain. Providers have typical names such as google for Google Workspace, selector1 and selector2 for Microsoft 365, k1 for Mailchimp and s1/s2 for some others. If you cannot get a message, press the button that tries 15 common names. It reports every one that has a key.
What the page checks
For the key it fetches, the page decodes the public key to find the real size in bits, not the length of the text, and states whether that meets the current recommendation. 2048-bit RSA is recommended; 1024-bit is the minimum RFC 8301 allows and is considered weak; smaller keys are rejected by modern receivers. It also looks for the revoked state (empty p=), testing mode, and an unrecognised key type. Because many providers publish the key as a CNAME to their own DNS, the resolver follows it and the page shows the final record.
A worked example
Press Sample to check selector google at github.com. The page prints the name google._domainkey.github.com, key type rsa, key size 2048 bits, status active, the start of the record (v=DKIM1; k=rsa; p=MIIBIjANBgkq…) and the message “A 2048-bit RSA key meets the current recommendation”. The characters MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A at the start of the key are the usual beginning of a 2048-bit RSA public key in Base64. A retired selector shows the opposite: a record with an empty p= and the status revoked.
Limits
A key in DNS shows that someone could verify signatures made with it. It does not show that your mail servers sign with that selector, or that the signature will align with the From domain for DMARC. For that, send a message to a mailbox you control and read its authentication results. The fifteen-name search tries common names only, so a custom selector will not be found; use the header instead. Next, check the sender list with the SPF Record Checker and the policy with the DMARC Checker.
Related tools
- SPF Record Checker lists the servers allowed to send.
- DMARC Checker shows how receivers treat mail that fails both.
- TXT Record Lookup displays the raw record.
- Base64 Encoder decodes the key text if you want to inspect it.
Checked against the current version of the DKIM Record Checker on .