Free Tool · DKIM
DKIM Inspector
Find the DKIM keys published for a domain, and check the things that quietly break signing: key length, test mode, and revoked selectors.
Free · no signup · reads public DNS only ·
What the DKIM Inspector checks
DKIM signs outgoing mail with a private key and publishes the matching public key in DNS, at <selector>._domainkey.yourdomain.com. A receiver reads the signature header, fetches that key, and verifies it. Because the signature travels with the message, DKIM survives forwarding where SPF does not — which makes it the mechanism usually holding DMARC together for mailing-list and forwarded mail.
Why no tool can list your selectors
DNS has no operation that enumerates what exists under a name. You can ask “what is at google._domainkey.example.com” and get an answer, but you cannot ask “what exists under _domainkey.example.com” at all. So every DKIM checker, including this one, is either guessing from a list or being told the selector. We try the selectors the major providers use and report which results came from a guess. If we find nothing, that means we did not guess yours — not that you have no DKIM.
What we can tell you about a key
Length. RFC 8301 §3.2 sets 1024 bits as the floor for RSA and recommends 2048. 1024-bit keys are still surprisingly common — often because a provider generated one years ago and nothing has forced a rotation since.
Test mode. A t=y flag tells receivers to treat a failed signature as though the message were unsigned. It exists so you can roll DKIM out without breaking anything, and it is very often left switched on afterwards, which means the signature is decorative.
Revocation. An empty p= revokes the key. That is the correct way to retire a selector — but it is a problem if anything is still signing with it.
Frequently asked questions
Why does it say no key found when I know I have DKIM?+
Because your selector is not one of the ones we guess. DNS cannot be enumerated, so there is no way around this — put your selector in the box above and we will check it directly. Your provider names the selector when it gives you the record to publish.
How do I find my selector?+
Send yourself a message and look at the DKIM-Signature header: the s= tag is the selector. Alternatively your sending provider documents it — Google Workspace uses google, Microsoft 365 uses selector1 and selector2, Mailchimp uses k1.
Is a 1024-bit key a real problem?+
It is below what RFC 8301 recommends, and some receivers are stricter than others about it. It is not usually an emergency, but if your provider offers 2048-bit rotation it is worth doing — and if it does not, that tells you something about the provider.
What does t=y mean?+
Test mode. Receivers are told to treat a signature failure as though the message were unsigned, which means the signature does nothing for you. It belongs in a rollout and nowhere else.
Can I have more than one selector?+
Yes, and you usually should — one per sending service, so you can rotate or revoke each independently. Finding several here is normal and healthy.
Check something else
- SPF Inspector
Will my SPF record pass, or has it quietly gone over the lookup limit?
- DMARC Inspector
Can someone send mail as my domain right now?
- DNSSEC Analyzer
Is my zone signed, is the chain actually complete, and are the signatures fresh?
Understand it, then fix it
- Why legitimate mail fails DMARC
How the protocol behaves, and why.
- DMARC alignment
How the protocol behaves, and why.
- DKIM Key Management
Step by step, in the CertaDNS dashboard.
- Email Authentication
What we automate, and what it costs.
- All free tools
Every check we publish, in one place.