Fromly

DKIM Checker

Find the DKIM keys of your domain, check that they can sign your emails, and read what each part of the key means. Add your selector if you know it.

What is DKIM?

DKIM, short for DomainKeys Identified Mail, is a digital signature on every email you send. Your sending service signs each message with a private key that only it holds. The matching public key is published in your DNS.

When your email arrives, the receiving server fetches that public key and checks the signature. If it matches, two things are proven: the email really came from your domain, and nobody changed it on the way.

Without DKIM, Gmail and Yahoo trust your email less, and DMARC has only SPF to rely on, which breaks as soon as an email is forwarded.

What is a DKIM selector?

A domain can have many DKIM keys, one for each service that sends for it. The selector is the name that tells them apart. The key for selector google lives at google._domainkey.yourcompany.com, the key for s1 at s1._domainkey.yourcompany.com.

DNS cannot list every selector of a domain, so the checker tries the ones common services use: Google Workspace, Microsoft 365, Mailchimp, SendGrid, Resend and many more. If yours is not found, enter your selector next to the domain.

To find it, open an email you sent and look at its original source or headers. In the DKIM-Signature line, the selector is the value after s=, and the domain it belongs to is after d=.

How to read your DKIM record

A DKIM key is a short list of tags.

  • `v=DKIM1` marks the record as a DKIM key.
  • `k=rsa` is the key type. RSA is by far the most common; ed25519 is newer and shorter.
  • `p=` holds the public key itself, a long string of characters. An empty p= means the key was revoked on purpose.
  • `t=y` means the key is in testing mode: receivers may ignore failed signatures. Remove it once everything works.

DKIM key length: 1024 or 2048 bits?

The longer the key, the harder it is to forge. 2048-bit keys are the recommendation today, and what most providers create by default. A 1024-bit key still works and still passes, but it is weaker, and some security reviews flag it.

Anything below 1024 bits is considered broken, and many receivers ignore it. The checker estimates the size of every key it finds and tells you if one should be replaced. To upgrade, generate a new key in your sending service, publish it under a new selector, then remove the old one.

DKIM, SPF and DMARC work together

DKIM proves an email is genuine, SPF lists the servers allowed to send it, and DMARC tells receivers what to do when both fail. Gmail and Yahoo expect all three from anyone sending in volume.

Check the other two with our free SPF Checker and DMARC Checker, or everything at once with the Deliverability Setup Checker.

Read the full guide

AuthenticationWhat is DKIM? How email signatures workLearn how DKIM (DomainKeys Identified Mail) works, what a DKIM key is, and how to set it up to protect your emails from spoofing and improve deliverability. · 8 min read

FAQ

DKIM Checker: questions, answered

How do I check my DKIM record?
Enter your domain above. The checker tries the selectors common services use and shows every key it finds. If you know your selector, enter it to check that key directly.
Why does the checker not find my DKIM key?
Your service probably uses a selector that is not on the common list. Find it as s= in the DKIM-Signature header of an email you sent, and enter it next to the domain.
Can a domain have several DKIM keys?
Yes, and it usually should: one for each service that sends email as your domain, each under its own selector. They do not conflict with each other.
What does an empty p= mean?
The key has been revoked. Emails signed with it will fail DKIM. If the selector is still in use, publish a new key from your sending service.
Is a 1024-bit DKIM key still okay?
It still works and passes DKIM, but 2048 bits is the recommendation. Rotate to a 2048-bit key when your sending service lets you.
Does DKIM need to match my From domain?
For DMARC, yes: the d= domain in the signature must match your From domain, or be part of it with relaxed alignment. A signature from your provider's own domain proves nothing about yours.

More free tools

Turn your signups into customers with email

Connect Supabase and Stripe, let your agent draft your first flow, and send your first 1,000 emails for free.

Start with 1,000 free emails