Bitelio
§ T-06  —  Tool← All tools

DKIM record
checker

Enter a domain and selector to fetch the published DKIM key. See whether it's active, what each tag means, and what to do if something is off.

DKIM record lookup

Don't know yours? Pick from the common ones below.

Common selectors

§ 01DKIM explained

DKIM under the hood.

A signature that vouches for both the sender and the content of every message.

Cryptographic signature

Outgoing mail is signed with a private key held by your server; the public half lives in DNS. Receivers check the two against each other to confirm the mail is genuine.

Selector system

Selectors let one domain carry several keys at once — handy for rotating keys safely or running multiple sending providers side by side.

Tamper detection

The signature is computed over the body and selected headers. Change anything en route and verification breaks — so recipients know when content was manipulated.

Key rotation

Rotate keys roughly once a year: publish the replacement under a new selector, point your sending infrastructure at it, then retire the old key by blanking its p= value.

DKIM alone is not enough

A valid signature says nothing about the From header a reader sees. As with SPF, you need DMARC to bind DKIM results to that header and shut down spoofing.

2048-bit RSA minimum

1024-bit RSA no longer holds up. Go 2048-bit at minimum, or adopt Ed25519 for the same security in a fraction of the key size.

Signed mail gets delivered.

DKIM signing is switched on for you automatically, with guided SPF and DMARC setup for your domain alongside it.

Start with BitelioWhat is DKIM?

Frequently asked questions

What is DKIM?

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every email you send. Receiving servers fetch the matching public key from your DNS and check the signature against it — a valid match proves the message genuinely came from your domain and wasn't modified along the way.

What is a DKIM selector?

The selector is the label that tells receivers which of your DKIM keys to fetch, since one domain can publish several. Each sending service chooses its own string — Google Workspace uses "google", Microsoft 365 uses "selector1", Mailchimp uses "k1" — and the record itself lives at {selector}._domainkey.{domain}.

Where do I find my DKIM selector?

It comes from whoever sends your email. Google Workspace typically uses "google", Microsoft 365 uses "selector1" and "selector2", and Mailchimp uses "k1". You can also open a message you've already sent and read the "s=" tag inside its DKIM-Signature header, or consult your provider's DNS setup documentation.

Why is my DKIM key revoked?

Publishing a DKIM record with an empty p= value is the standard way to revoke a key — it deliberately signals the key must no longer be used. It usually follows key rotation, a suspected compromise, or a switch of email providers. If the revocation wasn't your doing, review your DNS zone and publish a fresh key.

Should I use RSA or Ed25519 for DKIM?

For universal compatibility, 2048-bit RSA remains the safe default — every provider can verify it. Ed25519 delivers equivalent security with far smaller keys, but some older mail servers can't handle it. The best practice is publishing both under separate selectors, so modern receivers use Ed25519 while everyone else falls back to RSA.