DKIM
Enter a domain above to run this check.
DKIM
CHECK.
Look for the DKIM key of the domain on common selectors (selector1, google, default…), see the RSA key size and whether it was revoked.
Runs only this check. For all 33 checks at once, use the full Domain X-Ray. Public lookups only; nothing is stored on the server.
WAITING
What the check verifies
Looks for DKIM keys on six common selectors: selector1, selector2, google, default, s1 and s2.
Why it matters
DKIM signs messages, and Gmail and Yahoo require signatures from bulk senders. Not finding it on the common selectors does not mean it is missing: the real selector shows in the DKIM-Signature header.
What each result means
- WARNING
- A 1024-bit RSA key: generate a 2048-bit one.
- INFO
- A key was found on a common selector, which confirms the key in DNS but not that every message goes out signed; or no key on the 6 selectors tested.
ERROR and TIMEOUT mean the query did not finish (the source was down or slow), not a problem with the domain: run the check again.
How to fix
Generate the 2048-bit key at the email provider and publish the TXT on the selector it gives you. The real selector shows in the s= of the DKIM-Signature header of a message you sent:
dig TXT google._domainkey.example.com +short
# header: DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=google; …Would rather have someone else do it? Bit Happens can fix this →
More checks in Email
Test a selector in Email Health →
Full Domain X-Ray: all 33 DNS, email, HTTPS, certificate and reputation checks at once →