Free tool, no signup

Free DKIM checker

Enter a domain, and your selector if you know it, to find your DKIM keys and check their size. We check SPF, DMARC and MX at the same time.

Tries 14 common selectorsMeasures key sizeNothing is stored

We also try 14 common selectors (google, selector1, selector2, s1, k1…).Checks MX, SPF, DKIM and DMARC. Nothing is stored.

Your report will show:

DKIMKeys under 14 common selectors and their size

DMARCPolicy, report address and RFC 9989 issues

SPFYour record, DNS lookups out of 10, and errors

MX (receiving mail)Where replies and bounces go

What DKIM does

DKIM adds a digital signature to every message you send. The receiver fetches your public key from DNS and checks the signature, which proves the message came from your domain and was not changed on the way.

The signature sits in the DKIM-Signature header. Its d= value is the signing domain and s= is the selector, which tells receivers where to find the key: selector._domainkey.yourdomain.com.

How to find your selector

Send yourself an email from the address you want to check.
Open it and choose “Show original” (Gmail) or “View message source” (Outlook).
Find DKIM-Signature and read the s= value. Enter it in the selector field above.
Check that d= is your own domain. If it is your email tool’s domain, DKIM will not align for DMARC.

Common selectors by provider

Provider	Selector	Key size
Google Workspace	`google` (default)	2048 or 1024 bits; Google recommends 2048
Microsoft 365	`selector1`, `selector2`	1024 bits by default; 2048 supported

Key size and rotation

Gmail requires DKIM keys of at least 1024 bits and Google recommends 2048. The checker reads the public key and shows its real size, so you can see which selectors still use a 1024-bit key.

Rotate keys by publishing the new one under a new selector, switching your sender to it, and only then removing the old record.

Questions

Frequently asked questions

What is a DKIM selector?

The selector names one DKIM key, so a domain can have several. The public key lives at selector._domainkey.yourdomain.com. Google Workspace uses google by default; Microsoft 365 uses selector1 and selector2.

Why can’t the checker find my DKIM key?

DNS cannot list a domain’s selectors, so we try 14 common ones. If yours is different, open an email you sent, show the original message, find the DKIM-Signature header and enter its s= value. Also check that the d= value is your domain.

Should my DKIM key be 1024 or 2048 bits?

Use 2048 bits when your DNS host supports it. Gmail requires at least 1024 bits and Google recommends 2048. Microsoft 365 creates 1024-bit keys by default and supports 2048.

Do I need DKIM if I already have SPF?

Yes. Gmail, Yahoo and Outlook.com require both SPF and DKIM from bulk senders. DKIM also survives forwarding, where SPF often fails, and it is what usually aligns DMARC for mail sent through a third-party tool.

What does an empty p= mean?

An empty p= value means the key has been revoked. Mail signed with that selector will fail DKIM. Publish a new key or switch your sender to a selector that has one.

Official sources

What this page is based on

Checked October 27, 2026. Mailbox providers change their rules; the linked pages are authoritative. This tool reads public DNS only and is not a guarantee of inbox placement.

More free tools

DMARC checkerCheck your DMARC policy, reports and RFC 9989 issues, with a copy-ready fix.SPF checkerSee your SPF record, count its DNS lookups against the limit of 10 and catch errors.Email spam word checkerPaste a cold email to flag spam-trigger phrases, missing personalization and risky formatting.Cold email templates40 signal-based examples and the 2026 Gmail, Yahoo and Outlook sender rules.

Your domain is ready. Who should you email?

Looply finds people showing buying signals, scores them against your ideal customer profile and sends personalized cold email from your own connected inboxes.

Try Looply free for 7 days