DKIM Checker & Selector Finder

Check a domain's DKIM records live: probe 145 common selectors (Microsoft 365, Google, Mailchimp, SendGrid, Mailgun and more), see each key's type and RSA length, and spot revoked, test-mode, weak or dangling keys.


Enter a domain and click Check DKIM.

How to use it

  1. Enter a domain (or paste an email address). The page asks Cloudflare's public DNS-over-HTTPS resolver for <selector>._domainkey.<domain> TXT records for every common selector, following CNAMEs, and falls back to Google's resolver if Cloudflare fails.
  2. DKIM selectors can't be listed from DNS, so a checker can only test names it knows. If your sender isn't found, open a message it sent, find the DKIM-Signature header and add its s= value as an extra selector (the d= value is the domain).
  3. Read the verdict for each key: 2048-bit RSA or Ed25519 is good, 1024-bit is weak but still accepted, anything shorter is broken. An empty p= means the key was revoked on purpose. t=y means the sender is in test mode.
  4. A CNAME that leads to no key is a dangling selector. For Microsoft 365 that's normal for the inactive selector after rotation; for other services it usually means DKIM was set up and then removed at the provider.

Audit hundreds of domains at once

Need SPF, DMARC and MX checks across a whole client list? Run the Bulk SPF / DMARC / MX Auditor on Apify ($2 per 1,000 domains).

Checking a whole domain list?

This page checks one domain at a time. The DKIM Selector Finder on Apify runs the same probe across thousands of domains, adds an extended list of about 355 selectors plus date-based ones, and exports CSV or JSON ($2 per 1,000 domains).

Related tools

Paste a single key into the DKIM Record Explainer for a tag-by-tag breakdown, check SPF, DKIM and DMARC together with the Email Deliverability Checker, or follow the DKIM for Microsoft 365 guide.

FAQ

How do I find a domain's DKIM selector?

Selectors can't be listed from DNS. Either test known names (this page tries 145 common ones) or open an email the domain sent and read the s= value in the DKIM-Signature header. The selector record lives at s-value._domainkey.domain.

What DKIM selectors does Microsoft 365 use?

selector1 and selector2, published as CNAMEs that point at Microsoft-hosted keys. Only one is active at a time; after a rotation the other can point at a name with no key, which is normal.

What DKIM key length should I use?

2048-bit RSA. 1024-bit keys still verify but are weak, keys under 1024 bits are ignored by major receivers, and RFC 8301 says verifiers need only accept up to 4096 bits. Ed25519 (RFC 8463) is also valid but not every receiver supports it, so pair it with an RSA key.

What does an empty p= mean in a DKIM record?

The key has been revoked on purpose. Mail signed with that selector fails DKIM, which is how senders retire old keys.

Why does this checker find no DKIM when my mail is signed?

Your sender probably uses a selector that isn't in the common list, such as an account-specific Amazon SES or HubSpot selector. Add the s= value from a real message's DKIM-Signature header as an extra selector.

Want the full kit?

Runbooks, checklists and helpdesk templates: IT Admin Packs on Gumroad.