DKIM Record Checker
Find a domain’s DKIM keys at common selectors (or the one you enter), and check their size and settings.
DKIM signs each outgoing message with a private key; receivers fetch the public key from DNS at selector._domainkey.your domain and check the signature. A valid signature from your domain is what lets DMARC pass when mail is forwarded.
Finding your selector
Selectors can be any name. Open a message you sent, view its headers and find the DKIM-Signature line: the s= value is the selector and d= the domain. Without one, this tool tries the selectors used by Google, Microsoft 365, Zoho, Proton, Fastmail, Amazon SES, Mailchimp, SendGrid, Resend and others.
What key size should DKIM use?
2048-bit RSA. 1024-bit keys still work but are considered weak; keys under 1024 bits are rejected by Gmail and others.
Why does it say no DKIM key found?
Only common selector names can be guessed. Enter the s= value from a sent message’s DKIM-Signature header to check your actual key.
What does an empty p= mean?
The key has been revoked. Signatures made with it fail.
Clean a whole list
Upload a CSV and get every address checked: syntax, domain, mailbox, catch-all and disposable.
Start with 100 free credits- Finds the email column in any CSV, keeps your other columns
- Deliverable, risky, undeliverable or unknown, with the reason for each
- Download everything, or only the addresses that are safe to send to
- An API for sign-up forms and CRMs
- Lists are deleted after 30 days