Skip to main content
PPenTesting.org

Find your DKIM key and check it is strong enough

Enter your domain and we try the selectors used by Google Workspace, Microsoft 365 and other common platforms. Know your selector? Add it for an exact answer.

Reads public DNS records only, the same ones every mail server reads. We do not keep your domain or the results. Own a domain and want it left out? Publish a TXT record reading exclude at _pentesting-org.yourdomain.

How a receiving mail server checks your domainYour mail server sends a message. The receiving server looks up your public DNS records and asks: Does the signature match the key? The message is then delivered, sent to spam or rejected.Your mail serversigns each messagemessageReceiving serverDKIM checkDNS lookupTXT at selector._domainkey.example.comv=DKIM1; k=rsa; p=MIIB…InboxSpamRejectedDoes the signature match the key?
Every receiving server asks the same question of your public DNS. This check reads the same records.

How a receiver finds your key

A DKIM signature names a selector and a domain. The receiver joins them into a DNS name, fetches your public key, and checks the signature with it.

How a DKIM selector finds the public keyThe email header carries s=selector and d=domain. The receiver looks up selector._domainkey.domain to fetch the public key.EMAIL HEADERDKIM-Signature: v=1;s=selector1d=example.comb=signature…DNS LOOKUPselector1._domainkey.example.comPublic key found2048-bit RSA
DNS cannot list every selector, so a checker tries the common ones. The s= value in a sent email’s header tells you yours.

What a good DKIM set-up looks like

  • Every service that sends as you signs with your own domain, not only its own.
  • Keys are 2048-bit RSA (or Ed25519 alongside RSA).
  • Old selectors are withdrawn after you rotate keys.

Questions

What is a DKIM selector?

A name that points to one of your public keys. Your mail server puts it in every signed message as "s=", and receivers look up selector._domainkey.yourdomain to fetch the key. One domain can have several selectors, one per sending service.

How do I find my DKIM selector?

Open an email you sent, view the original message or headers, and find the DKIM-Signature line. The value after "s=" is the selector and the value after "d=" is the signing domain. Your email provider’s DKIM settings page also shows it.

Why does the checker say no key was found when I have DKIM set up?

DNS has no way to list every selector, so a checker can only try names it knows. If your provider uses an unusual one, enter it in the selector box. A missing result here is not proof that DKIM is off.

Is a 1024-bit DKIM key still OK?

It is the minimum. RFC 8301 says signers must use at least 1024 bits and should use 2048. Most providers offer 2048-bit keys; switching is usually a new key in the provider’s settings and a new DNS record.

What does an empty p= mean?

The key has been withdrawn. Mail signed with that selector will fail DKIM. That is normal after rotating to a new key, as long as your mail is now signed with the new selector.

More email checks

Email security checker (all checks) →SPF checker →DMARC checker →

PenTesting.org is an independent editorial directory. We are not an accreditation body or association and are not affiliated with CREST, the NCSC, OWASP, PCI SSC, or ISO. Accreditations are reported from public sources, with the evidence linked on each listing.