DKIM checker: find and test your keys.
We probe more than 70 common DKIM selectors (Microsoft 365, Google Workspace, Mailchimp, SendGrid and more), check key strength and tell you how to fix weak or missing keys.
- Free, no sign-up
- Results in seconds
- 8 standards checked
- Email yourself the report
A tamper-proof seal on every email.
DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. Your mail platform signs with a private key; the matching public key is published in your DNS so any receiver can check the message really came from you and wasn’t altered.
Unlike SPF, a DKIM signature survives forwarding, which makes it the most reliable way to pass DMARC.
Where providers publish their keys.
A selector is the name in front of ._domainkey where a key lives. DNS doesn’t let anyone list them, so we test the common ones for you.
- Microsoft 365selector1 and selector2, published as CNAME records pointing to your tenant.
- Google Workspacegoogle (the default prefix), published as a TXT record.
- Mailchimpk1, k2 and k3, published as CNAME records.
- SendGrids1 and s2, published as CNAME records.
- HubSpoths1 and hs2, published as CNAME records.
- Amazon SESThree random-looking selectors (Easy DKIM), published as CNAME records.
- Fastmail and Protonfm1 to fm3 (Fastmail) and protonmail, protonmail2, protonmail3 (Proton).
- Custom selectorsAny name your provider chooses. Enter it under "Advanced" to check it directly.
Strong keys, rotated.
- Use 2048-bit RSA keys1024-bit keys are the bare minimum and increasingly considered weak. Most platforms offer 2048-bit.
- Rotate keys regularlyRotating yearly limits the damage if a key ever leaks. Microsoft 365 makes it one click.
- Sign with every senderEach service that sends as you needs its own DKIM set up, not just your mailbox provider.
- Revoke old keys properlyPublish an empty key (p=) for retired selectors so old signatures stop validating.
How do I find my DKIM selector?
Open a recent email you sent, view the original message headers and look for the DKIM-Signature header. The selector is the value after "s=". Or check your email platform's DKIM settings.
How do I turn on DKIM in Microsoft 365?
In the Microsoft Defender portal, go to Email & collaboration, Policies & rules, Threat policies, Email authentication settings, DKIM. Publish the two CNAME records it shows, then switch signing on for your domain.
How do I turn on DKIM in Google Workspace?
In the Google Admin console, go to Apps, Google Workspace, Gmail, Authenticate email. Generate a 2048-bit key, publish the TXT record at google._domainkey, then click Start authentication.
Is a 1024-bit DKIM key still OK?
It still works, but 2048-bit is the current recommendation and widely supported. Upgrade when you next rotate keys.
DKIM missing or weak?
We'll switch on DKIM for every service that sends as you, with 2048-bit keys and a rotation schedule.
Tell us about your IT.
We answer almost every inquiry within one business day.