DKIMchecker.
Check that your domain's DKIM key is published, that it reads correctly and that it's long enough. Leave the selector empty and we try the common ones.
How it works
- Enter your domainAnd your selector, if you know it
- See the keyPublished, its length and any problems
- Fix and recheckMost fixes are in your mail provider
Free, no sign-up. Checked live from our server. Nothing is stored.
The tool
Check a DKIM key
Leave the selector empty and we try the ones the common providers use.
Understanding DKIM.
What the result means, and how to fix what it finds.
What DKIM does
DKIM signs every email you send with a private key that only your mail provider holds. The matching public key sits in your DNS. A receiving server uses it to check that the email really came from your domain and wasn't changed on the way. Together with SPF, it's what DMARC uses to decide if an email is genuinely yours.
What a selector is
A domain can have several DKIM keys, each published under a name called a selector (for example google._domainkey.yourdomain.com). Your mail provider chooses it. Google Workspace uses google, Microsoft 365 uses selector1 and selector2, and other services use their own names. If we don't find a key, look up your selector in your provider's DKIM settings and enter it.
Turning it on
DKIM isn't on by default everywhere. In Google Workspace it's under Apps, Gmail, Authenticate email: generate a key, publish it as a TXT record, then press Start authentication. Microsoft 365 uses two CNAME records. Until signing is switched on, publishing the key alone does nothing.
Key length
2048-bit keys are today's standard. A 1024-bit key still works, but some receivers treat it as weak, so rotate it when you can. Anything shorter should be replaced. If the key is in test mode (t=y), receivers may ignore DKIM failures; remove the flag once signing works.
Why DKIM fails after it worked
A DKIM pass can turn into a fail without anyone touching DNS. Common causes: a new email footer or link-tracking service that changes the message after it is signed, a forwarding rule that edits the subject, or the key being rotated at the provider while DNS still holds the old one. If DKIM suddenly fails, send a test email to Gmail, open Show original and compare the selector in the DKIM-Signature header with the record in your DNS. If they differ, publish the new key. If they match and the signature still fails, look for something that edits messages on the way out.
In mailzy
Every domain checked, every day.
mailzy watches each sending domain's records and blocklists, so a broken DKIM key shows up before your reply rate drops.
Questions before you start.
Ask us on the chat if yours isn't here. A real person answers.
Why does it say no key found?
Either DKIM isn't set up, or your provider uses a selector we didn't try. Find the selector in your mail provider's DKIM settings and enter it.
Is DKIM required?
For Gmail and Yahoo, everyone needs SPF or DKIM, and bulk senders need both. In practice, cold email without DKIM rarely reaches the inbox.
Can I have more than one DKIM key?
Yes. Each service that sends for you can have its own key under its own selector.
More free tools.
Domain Health Checker
One score for a sending domain: SPF, DKIM, DMARC, MX, blocklists and Gmail's and Yahoo's sender rules.
Open the toolSPF Record Generator
Build one valid SPF record from the services you send with, with the 10-lookup limit counted.
Open the toolDMARC Record Generator
Create a DMARC record with the right policy and report address, with every tag explained.
Open the toolEverything for cold email, in one place.
Start free for 14 days. No card needed.