DKIM lets a receiving server confirm that an email really came from your domain and wasn’t changed on the way. Your email service signs each message with a private key; the matching public key sits in your DNS at a name called the selector. If the key is missing, broken or revoked, the signature fails.
What this DKIM checker shows
Enter a domain, and a selector if you know it. The checker:
- Looks for keys at 24 common selectors at once, plus your own selector and guesses from your mail servers, and lists every key it finds. Most domains have several, one for each service that sends for them.
- Names the service behind each selector it recognizes, such as Google Workspace, Microsoft 365, SendGrid, Klaviyo or Mailchimp.
- Follows CNAMEs to the key your ESP hosts.
- Reads each key: the type (RSA or Ed25519), the size in bits, whether it has been revoked (an empty
p=), and whether it is still flagged as testing (t=y).
Common DKIM problems
No key found. Usually the selector, not DKIM. Find yours in your ESP’s domain settings or in the s= of a sent message’s DKIM-Signature header, and check again.
The service signs as its own domain. The key can be fine and DMARC can still fail, because the service signs with d= set to its domain rather than yours. Turning on domain authentication (sometimes called custom DKIM or branded sending) in the service fixes it.
A broken key. Long keys are split into several strings, and a missing quote or space when pasting breaks them. Copy the value from your ESP again.
A 1024-bit key. It works, but rotate to 2048 bits when your ESP lets you.
Still in testing mode. t=y asks receivers to treat failures as unsigned. Remove it once signing works.
DKIM is one of three
DKIM signed as your own domain is the most reliable way to pass DMARC, because it survives forwarding where SPF doesn’t. Check the other two with the SPF checker and the DMARC checker, or run all three at once with the email deliverability test.