TR

DKIM checker: look up a DKIM key

Look up the DKIM public key a domain publishes for a selector, or try the default selectors of common mail providers, and see whether the key parses, how long it is and whether it is revoked.

wikipedia.orggithub.comcloudflare.commozilla.orgbbc.co.uk

Why DKIM needs a selector

A DKIM key is published as a TXT record at selector._domainkey.your-domain. The selector is a label chosen by whoever sends the mail, and a domain can have many: one per mail provider, rotated over time. DNS offers no way to list them, so a DKIM lookup needs the selector.

You find it in any message the domain has sent: open the message source and read the DKIM-Signature header. The s= tag is the selector and d= is the signing domain. If you leave the selector empty, OrbitProbe tries a fixed list of selectors that large providers use by default. A miss on that list does not mean the domain has no DKIM.

Reading the result

v=DKIM1 identifies the record, k= gives the key type (RSA unless stated, or ed25519) and p= holds the public key. For RSA keys the tool decodes the key and reports its length: 2048 bits is the current norm, 1024 still verifies but should be rotated, and anything shorter is rejected by major receivers. An empty p= means the key has been revoked on purpose. t=y marks the domain as still testing DKIM.

A valid key in DNS is half of DKIM. The other half is the sending server actually signing with the matching private key, which only a real message can show. Check the Authentication-Results header of a delivered message for dkim=pass.

FAQ

How do I find my DKIM selector?

Open the source of an email sent from the domain and find the DKIM-Signature header. The value after s= is the selector. Mail providers also show it on their domain authentication page.

No DKIM record was found. Does the domain not use DKIM?

Not necessarily. Without a selector only common defaults are tried. Get the selector from a real message and check again.

What DKIM key length should I use?

2048-bit RSA. Some DNS hosts need the record split into several quoted strings because a single string is limited to 255 characters; that is normal and handled here.

What does an empty p= mean?

The key was revoked. Messages signed with that selector no longer verify. It is the standard way to retire a key.

Is DKIM enough to stop spoofing?

No. DKIM proves a message was signed by a domain. DMARC is what tells receivers to require that the signing domain matches the visible From address, and what to do when it does not.