# DKIM checker

> A DKIM checker looks up the public key a domain publishes at selector._domainkey.yourdomain.com and validates it. It confirms the record exists, the key parses, and the key is long enough (2048-bit RSA is the current standard). The free checker on this page tries common selectors for you.

This site is run by Vigilbase (https://vigilbase.com), a managed security provider. It covers: dkim checker.

## Run the check

- In the browser: https://dkimcheckers.com/ (results shown on the page)
- API: POST https://api.vigilbase.com/tools/v1/agent/tools/email-security/execute with {"target":"example.com"}

## How DKIM works

Your mail server signs each outgoing message with a private key. The receiving server reads the selector in the DKIM-Signature header, fetches the matching public key from DNS, and checks the signature. A pass proves the message came from a server you authorised and was not changed on the way.

A DKIM public key record (shortened). The selector here is google:

```
google._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
```

## What to check

- The selector record exists for every service that sends mail for you (Google Workspace, Microsoft 365, your marketing and billing tools).
- The key is RSA 2048-bit or Ed25519. 1024-bit keys are considered weak.
- The record is not split or truncated by your DNS host. Long keys must be published as one TXT value or correctly joined strings.
- Old selectors for tools you no longer use are removed.

## Common DKIM selectors by provider

| Provider | Typical selector(s) |
| --- | --- |
| Google Workspace | google |
| Microsoft 365 | selector1, selector2 |
| Mailchimp | k2, k3 |
| SendGrid | s1, s2 |
| Amazon SES | Random tokens set up per domain |

## Why DKIM fails

- The selector in the message header has no matching DNS record.
- A mailing list or security gateway changed the message body or signed headers after signing.
- The key in DNS was rotated but the sending service still signs with the old one.

## FAQ

### What is a DKIM selector?

A label that tells receivers which public key to use, such as google or selector1. The key lives at selector._domainkey.yourdomain.com, so one domain can have a key per sending service.

### How do I find my DKIM selector?

Open the headers of an email you sent and find the s= value in the DKIM-Signature header. The checker also tries the selectors that common providers use.

### What DKIM key length should I use?

2048-bit RSA. Many providers still default to 1024-bit, which is now considered weak, so rotate to 2048 where your DNS host supports it.

### Is this DKIM checker free?

Yes. The check runs on vigilbase.com at no cost and needs no account.

## Related

- [Run the free email security check](https://vigilbase.com/tools/email-security)
- [Check DMARC next](https://vigilbase.com/tools/dmarc-checker)
- [Full email security check](https://vigilbase.com/tools/email-security)
- [SPF record generator](https://vigilbase.com/tools/spf-generator)
- [DMARC record generator](https://vigilbase.com/tools/dmarc-generator)
- [MTA-STS checker](https://vigilbase.com/tools/mta-sts-checker)
- [BIMI checker](https://vigilbase.com/tools/bimi-checker)