DKIM Record
Probe selectors and inspect key size, testing mode and revoked keys.
Enter a target
e.g. example.com — press ⏎ / ⌘⏎
What is DKIM Record?
The DKIM tool reads the public key at <selector>._domainkey.<domain> and reports key type, RSA key size, the testing flag and revoked keys.
DKIM has no discovery mechanism: the selector is specific to the sending system and only appears in the s= value of a real message's DKIM-Signature header. The tool therefore probes 40 common selectors — an empty result means "not in that list", not "no DKIM".
Keys under 1024 bits are rejected by Google and Microsoft; 2048 is the recommendation. An empty p= means the key is revoked, and a t=y flag means DKIM isn't actually enforced.
Frequently Asked Questions
10 questionsI don't know my selector — how do I find it?
Selectors can't be discovered via DNS; they're specific to the sending system. Send yourself a message, open the raw headers and read s= in the DKIM-Signature line. This tool probes 40 common selectors — an empty result means "not in that list", not "no DKIM".
Why does key size matter?
RSA keys under 1024 bits are rejected outright by Google and Microsoft — the signature simply doesn't verify. 1024 is still accepted but considered weak. 2048 is the recommendation; 4096 is secure but can hit record-length problems at some DNS providers.
What does t=y mean?
Testing mode: it tells receivers to ignore signature failures. Useful during rollout, but if it's left in production DKIM is effectively not enforced at all. Remove it when you go live.
The p= value is empty — what happened?
The key has been revoked. Providers leave the old selector with an empty p= during rotation. Anything signed with it fails verification. Harmless if unused, an urgent outage if it's still signing mail.
Can I publish more than one selector?
Yes, and it's normal. Each sending system (Workspace, a marketing tool, an app server) uses its own selector, and key rotation temporarily requires two selectors live at once.
How often should I rotate the key?
Once or twice a year is fine, and immediately if you suspect exposure. During rotation publish the new selector, switch signing to it, and leave the old one live for a few days so in-flight mail still verifies.
How many selectors can one domain have?
No limit. It's normal and recommended for each sending system to have its own — corporate mail one, marketing tool another, application server a third — so revoking one key doesn't affect the rest.
Does a DKIM signature survive forwarding?
Usually yes: the signature covers the message, not the sending IP. It breaks if the forwarder rewrites the subject or appends a footer, which is why mailing lists use ARC.
Should I move to Ed25519?
Not on its own. Ed25519 (RFC 8463) is compact and strong but not universally supported, and an unsupporting receiver simply can't verify. If you adopt it, publish it alongside RSA as a second selector.
Should I use a 4096-bit key?
Not necessary. 2048 is sufficient against current and foreseeable threats; 4096 causes record-length problems at some DNS providers and raises verification cost.