DKIM Checker

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email. The matching public key is published in DNS so receivers can verify the message was not altered and really came from your domain.

A selector names which key to use, so a domain can rotate or run multiple keys. The public key lives at selector._domainkey.yourdomain. Common selectors are google, selector1/selector2 (Microsoft), k1 (Mailchimp) and default.

Look at the DKIM-Signature header of an email you sent (the s= tag), or check your email provider's DNS setup instructions.

At least 1024-bit RSA; 2048-bit is recommended. Keys below 1024-bit are considered weak and some providers reject them.

A DKIM failure means the signature did not verify, often because the message was altered in transit, the key was rotated, a mailing list modified the body, or the published public key does not match the signing key.

Yes. Each key uses its own selector, so a domain can run several keys at once for different senders, or overlap old and new keys during rotation without breaking verification.

Rotating keys periodically, such as a few times a year, limits the damage if a private key is ever exposed. Publish the new selector, switch signing to it, then remove the old record once no mail uses it.

RSA is the long-established, universally supported algorithm, while Ed25519 produces much shorter keys with strong security. Support for Ed25519 is growing, but publishing an RSA key alongside it keeps compatibility.