Free tool

Check your DKIM key, including whether it is revoked

Enter a domain and we look for a DKIM key at the selectors senders commonly use, and check whether it is live, revoked, weak, or in test mode. Because selectors are provider-specific, a miss means "not found", never "not there", and we mark it that way. This runs the full audit and leads with DKIM.

Why a DKIM check can never be exhaustive

DKIM has no fixed lookup location. The selector is chosen by whoever configured sending, so any checker can only try a dictionary of common ones. Google Workspace is the classic trap: its selector is a rotating date string that cannot be guessed, so google.com itself returns nothing for every common selector. A miss here means we could not confirm DKIM, not that it is missing.

Revoked and weak keys, which naive checks miss

A DKIM record with an empty p= tag is not healthy, it is explicitly revoked under RFC 6376, and any check that only asks "does p= exist" calls it healthy. We also read the key length (under 1024 bits is forgeable) and the t=y test-mode flag, which asks receivers to ignore DKIM failures and is often set during setup and forgotten.

Questions

About this check

Why could you not find my DKIM?

Because the selector, the label under which the key is published, is chosen by your sending provider, and there is no way to enumerate it. We try a long list of common defaults, but some providers use unguessable rotating selectors. If we do not find one, confirm in your sending tool which selector it uses and look it up directly; a miss from this tool is not evidence that DKIM is missing.

What is a DKIM selector?

It is a label that points to a specific public key, published at selector._domainkey.yourdomain. It lets you run more than one key at once (for different senders, or for rotation). Your ESP tells you which selector it signs with, and that is the record you publish.

Is a revoked key the same as no key?

Worse, in a sense. A revoked key is a published record with an empty public key, which explicitly tells receivers the key is dead, so mail signed with it fails DKIM. It usually happens when a key is rotated out incorrectly. If this checker reports a revoked key, re-publish the current public key from your provider.

Check your DKIM key, including whether it is revoked

Why a DKIM check can never be exhaustive

Revoked and weak keys, which naive checks miss

About this check

Cold emails that actually land

You’re on the list

Check your DKIM key, including whether it is revoked

Why a DKIM check can never be exhaustive

Revoked and weak keys, which naive checks miss

About this check

More checkers