DKIM checker — find your domain's DKIM keys
Enter a domain; we scan the 50 most common selectors. Know your selector? Send a test email — we read it from the header.
What DKIM is
DKIM (DomainKeys Identified Mail, RFC 6376) is a cryptographic signature the sending server adds to message headers. The public key lives in DNS at selector._domainkey.domain. The receiver verifies the signature — if the body or signed headers changed in transit, DKIM fails. DKIM survives forwarding (SPF does not), which is why it is the foundation of DMARC.
Typical problems
No signature — most common on self-hosted MTAs: Postfix without OpenDKIM/Rspamd. 1024-bit key — still accepted, but Google recommends 2048. Signed with the provider's domain (d=mailer.esp.com) — DKIM passes but is not aligned with From, so DKIM-based DMARC fails; configure your own domain at the ESP. Modification after signing — gateways adding disclaimers, mailing lists.
How to enable DKIM
Self-hosted Postfix: Rspamd (dkim_signing module) or OpenDKIM; 2048-bit key, dated selector (e.g. s2026a), TXT in DNS, rotate yearly. ESPs (Postmark, SES, Mailgun, SendGrid, Brevo): the “sending domain”/“authentication” section — the provider gives you CNAME/TXT records. Google Workspace: Admin → Gmail → Authenticate email. Microsoft 365: Defender → DKIM → enable for the domain (selector1/selector2 CNAME).
FAQ
Can I have several DKIM keys?
Yes, one selector per sending system. That is normal and recommended — each provider signs with its own key.
DKIM pass but DMARC fail — how?
The d= domain in the signature is not aligned with the From domain. Configure your provider to sign with your own domain.