DKIM checker
Enter a domain and a selector to read its DKIM key and check that it is valid and long enough. Leave the selector empty to try the common ones.
How to read the result
Each key found shows its selector, the record as published, and the key: RSA keys should be 2048 bits, 1024 still works, less fails. An empty p= means the key was revoked on purpose; t=y means test mode, where receivers may ignore failures.
A valid key only means signatures can be checked. For DMARC to pass on DKIM, the signing domain (d=) must match your From domain. See the policy with the DMARC checker, or run the whole domain health check.
Questions
- What is a DKIM selector?
- The name a DKIM key is published under: the key for selector google on example.com lives at google._domainkey.example.com. One domain can have many, one per sending service. Each signed email names its selector in the s= value of its DKIM-Signature header.
- How do I find my DKIM selector?
- Open a message you sent, show the original or raw headers, and find DKIM-Signature: the selector is after s=, the domain after d=. Your sending provider's domain settings also list the records it asked you to publish.
- Why does the search find nothing?
- It tries 24 selectors that services use by default. Amazon SES and Resend publish keys under generated names (three CNAME records with random selectors), which no list can guess. Enter the selector from your provider's settings.
- Is a 1024-bit DKIM key still OK?
- Receivers still accept it, but 2048 bits is the recommended size and what most providers generate now. Keys under 1024 bits are rejected by Gmail and others.
More free tools
No sign-up, nothing stored. All tools.
Domain email health check
SPF, DMARC, MX and blocklists for a domain in one report, with what to fix first.
SPF record checker
Parses the SPF record, counts its DNS lookups against the limit of 10 and says how to fix what breaks it.
DMARC checker
Reads the DMARC policy, report addresses and alignment, and says what the policy actually does to spoofed mail.
MX lookup
The mail servers of a domain, their addresses and who hosts the mailboxes.
Blocklist checker
A domain and its mail servers against public DNS blocklists.
Email provider lookup
Which mailbox provider and which sending services a domain uses.
Email address verifier
Format, mail servers, throwaway domains, role addresses and typos for one address.
Bulk email checker
Up to 100 addresses from a pasted list or a CSV, with a CSV of the results. Nothing stored.
Disposable email checker
Whether an address or domain belongs to a throwaway-mail service.
Email HTML preview
Paste email HTML, see it on desktop and phone with images on or off, and what breaks in Gmail and Outlook.
Merge tag tester
A template with {{tags}} and JSON data in, the email out, with every tag that would reach the recipient unfilled.
Subject line checker
How a subject and preheader look in iPhone Mail and Gmail, where phones cut them, and what reads like a pitch.