How do I find my DKIM selector?

Open a message you sent, view the raw headers, and look at the DKIM-Signature header. The value after s= is the selector; the value after d= is the signing domain.

How big should a DKIM key be?

2048-bit RSA. RFC 8301 requires verifiers to support 2048 and lets them reject anything under 1024. Some DNS providers need the key split across two TXT strings; this tool joins them.

Why does my provider use a CNAME for DKIM?

So they can rotate the key without you editing DNS. The CNAME points at a record they control. This tool follows the CNAME and reports the key it lands on.

DKIM checker

DKIM (DomainKeys Identified Mail) is a signature a sending server attaches to outgoing mail, verified by receivers against a public key published in DNS. This tool looks up the public key for a selector, checks its size, and catches revoked or test-mode keys. No selector? We scan the common ones.

What this tool checks

DKIM public keys live in DNS at selector._domainkey.domain. The tool fetches that TXT record (following a CNAME if the provider uses one), joins split strings, and reads the v, k, p and t tags. For RSA keys it estimates the modulus size from the encoded key.

Why key size matters

A 512-bit RSA key can be factored on rented hardware in hours, which lets an attacker sign mail as you. Receivers therefore ignore short keys, and mail signed with them is treated as unsigned. 2048 bits is the standard today.

DKIM and Spamjadoo

DKIM can only be verified once the message body has arrived, so on its own it cannot drive a handshake rejection. Spamjadoo uses it after the protocol checks: mail that passes the session is verified, aligned against DMARC, and quarantined or delivered according to the domain's policy.

Questions people ask

How do I find my DKIM selector?: Open a message you sent, view the raw headers, and look at the DKIM-Signature header. The value after s= is the selector; the value after d= is the signing domain.
How big should a DKIM key be?: 2048-bit RSA. RFC 8301 requires verifiers to support 2048 and lets them reject anything under 1024. Some DNS providers need the key split across two TXT strings; this tool joins them.
Why does my provider use a CNAME for DKIM?: So they can rotate the key without you editing DNS. The CNAME points at a record they control. This tool follows the CNAME and reports the key it lands on.