DKIM Checker

What to know about the selector

The DKIM key lives on a separate name of the form selector._domainkey.domain. You can read the selector from the DKIM-Signature header of any message sent from the domain: it follows the s= tag. If you do not know the selector, leave the field empty: the check will go through the selectors commonly used by mail providers and show which ones it tried.

What the record is checked for

The key length and type are measured from the key itself, not from the string length. An RSA key shorter than 1024 bits makes the signature invalid, and 1024 bits is the allowed minimum, with 2048 recommended. The check also flags an empty key (used to mark a revoked key), test mode t=y, the deprecated g tag, and a record that disallows mail with the s tag.

A string found under the selector name that does not look like DKIM does not count as a key. This happens with domains that use a wildcard record: any name gets an answer, and a check that only looks for the existence of a record gets it wrong.

What the check cannot show

The DNS record shows the state of the key, but not the fate of a specific message: the body hash is part of the signature, so you can only verify it against the full raw message.

The signature alone does not protect the From: address; that is the job of a DMARC record. The other records of a domain are covered by the TXT record lookup.