Free tool
DKIM checker
A DKIM checker looks up the public key a domain publishes at selector._domainkey.yourdomain.com and validates it. It confirms the record exists, the key parses, and the key is long enough (2048-bit RSA is the current standard). The free checker on this page tries common selectors for you.
- ISO 27001 compliant
- SOC 2 Type 2 compliant
- Preferred Cloudflare Partner
- 24/7 follow-the-sun support
How DKIM works
Your mail server signs each outgoing message with a private key. The receiving server reads the selector in the DKIM-Signature header, fetches the matching public key from DNS, and checks the signature. A pass proves the message came from a server you authorised and was not changed on the way.
google._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."What to check
- The selector record exists for every service that sends mail for you (Google Workspace, Microsoft 365, your marketing and billing tools).
- The key is RSA 2048-bit or Ed25519. 1024-bit keys are considered weak.
- The record is not split or truncated by your DNS host. Long keys must be published as one TXT value or correctly joined strings.
- Old selectors for tools you no longer use are removed.
Common DKIM selectors by provider
| Provider | Typical selector(s) |
|---|---|
| Google Workspace | |
| Microsoft 365 | selector1, selector2 |
| Mailchimp | k2, k3 |
| SendGrid | s1, s2 |
| Amazon SES | Random tokens set up per domain |
Why DKIM fails
- The selector in the message header has no matching DNS record.
- A mailing list or security gateway changed the message body or signed headers after signing.
- The key in DNS was rotated but the sending service still signs with the old one.
How Vigilbase helps
Vigilbase runs security operations and website protection for businesses that would rather not build a security team.
Email security
Phishing protection and DMARC enforcement, set up and kept current for you.
Learn moreVigilbase OS
AI investigates every alert and brings you only verified threats, with the fix ready to approve.
Learn moreVigilbase Shield
Managed Cloudflare WAF, DDoS and bot protection, configured and watched by our team.
Learn moreFrequently asked questions
What is a DKIM selector?
A label that tells receivers which public key to use, such as google or selector1. The key lives at selector._domainkey.yourdomain.com, so one domain can have a key per sending service.
How do I find my DKIM selector?
Open the headers of an email you sent and find the s= value in the DKIM-Signature header. The checker also tries the selectors that common providers use.
What DKIM key length should I use?
2048-bit RSA. Many providers still default to 1024-bit, which is now considered weak, so rotate to 2048 where your DNS host supports it.
Is this DKIM checker free?
Yes. The check runs on vigilbase.com at no cost and needs no account.
More free tools and guides
Security handled, around the clock
Vigilbase is ISO 27001 and SOC 2 Type 2 compliant and a Preferred Cloudflare Partner, with follow-the-sun support from teams in Kenya, South Africa, the UAE and Portugal.