How to Use the DKIM Checker
The Simple Answer
The DKIM Checker looks up a DKIM key at a domain and selector you enter, and shows its type and size. You need the selector your email provider gave you, because the key cannot be found from the domain alone.
What the tool does
DKIM lets a domain sign its email so receivers can check the message was not forged or changed. The signature is checked with a public key published in DNS at selector._domainkey.yourdomain. The selector is a label chosen by whoever sends the mail. An email provider may give you one such as google or selector1.
How to use it
- Type your domain, such as example.com. It is the part after the @ in your email address.
- Type the DKIM selector your email provider gave you.
- Press Check DKIM and read the answer, what it means and what to do next.
A worked example
The tool reads the key at that exact name: the version, the key type, and for an RSA key its real size, measured from the key itself. It flags a key that has been revoked (an empty p= value), a key marked as a test (t=y), and an RSA key under the minimum size set by RFC 8301. The key itself is never shown. If nothing is published at the selector you entered, it says no key was found at that selector. It does not say DKIM is missing for the domain.
Things to know
- Only the selector you enter is checked. A domain can have several selectors.
- Finding a key shows it is published. It does not show that your mail is being signed with it.
- The domain you enter is sent to our server, which asks Cloudflare's public DNS service about it. We do not visit the website, keep the domain or keep a history.
Common questions
Where do I find my selector? In your email provider's setup instructions for DKIM, or in the headers of an email you sent. Look for s= in the DKIM-Signature line.
Does no key found mean DKIM is not set up? Not necessarily. It means nothing was found at that selector. Try the selector your provider named.
DKIM Checker: Open the DKIM Checker and try your own numbers.