Find the DKIM public keys a domain publishes and check that they are strong enough. Enter your selector if you know it — or let us try 30+ selectors used by Google Workspace, Microsoft 365, Mailchimp, SendGrid, Brevo and other platforms.
DKIM report for
Every selector we tried returns an empty, revoked key. The domain most likely publishes a wildcard record that revokes DKIM for any selector — common for domains that send no e-mail at all.
| Selector | DNS name | Key type | Key size | State |
|---|
A revoked key has an empty p= tag: the selector was deliberately switched off, and signatures made with it fail. That is normal after a key rotation.
Perfect records do not stop bounces. Sending to invalid, disposable or abandoned addresses hurts your sender reputation and can get your IP blacklisted. Validate your list before the next campaign.
DKIM (DomainKeys Identified Mail, RFC 6376) lets a domain sign the e-mail it sends. Your sending platform adds a DKIM-Signature header made with a private key; the matching public key is published in DNS, as a TXT record at selector._domainkey.yourdomain.
The receiving server fetches that public key and verifies the signature. A valid signature proves the message was not altered in transit and that the signing domain takes responsibility for it. Gmail, Yahoo and Outlook require DKIM from bulk senders, and DMARC relies on it.
The selector is the label that tells receivers which key to fetch, so one domain can have several keys at once — one per sending platform, or an old and a new key during a rotation.
DNS has no way to list all the selectors of a domain, so no tool can discover every key by itself. The reliable way is to open a message you sent, view its original headers and find the DKIM-Signature line: s= is the selector and d= is the signing domain.
DKIM-Signature: v=1; a=rsa-sha256; d=yourcompany.com; s=google; …The selectors below are the defaults of popular platforms. Some providers generate a selector per account, so your admin console has the final word.
| Provider | Selector(s) |
|---|---|
| Google Workspace | |
| Microsoft 365 | selector1, selector2 |
| Mailchimp | k1 (older setups), k2, k3 |
| Mailchimp Transactional (Mandrill) | mandrill |
| SendGrid | s1, s2 |
| Brevo | brevo1, brevo2 |
| HubSpot | hs1, hs2 (some accounts add a numeric suffix) |
| Proton Mail | protonmail, protonmail2, protonmail3 |
| Fastmail | fm1, fm2, fm3 |
| Amazon SES | Three random tokens per domain (Easy DKIM) — copy them from the SES console |
| Zoho Mail | You choose it when you create the key in the Zoho Mail admin console |
RFC 8301 requires keys of at least 1024 bits and recommends 2048. Keys under 1024 bits are ignored by major providers; 1024-bit keys still work but are considered weak. If your DNS host limits TXT length, split the key into several quoted strings in the same record.
RFC 8463 adds short, modern Ed25519 keys, but many receivers do not verify them yet. If you use one, sign with an RSA key as well.
To retire a selector, publish its record with an empty public key (p=). Receivers then treat signatures made with it as invalid, and anyone looking can see the key was retired on purpose.
Publish a new selector, switch your platform to sign with it, wait a few days for messages in transit, then revoke the old one. Many teams rotate every 6 to 12 months.
Yes. You can run 30 checks a day without an account (shared with the SPF, DKIM and DMARC checker). The tool only reads public DNS records.
Because DKIM keys can only be found by knowing the selector, and your platform may use one we do not try. Open a message you sent, find the s= value in its DKIM-Signature header and enter it. Also make sure your platform signs with your own domain (d=yourdomain) rather than its own.
In the DKIM-Signature header of any message you sent: s= is the selector, d= the domain. Gmail shows it under “Show original”, Outlook under “View message source”. Your sending platform’s DNS setup page lists it too.
2048 bits. 1024-bit keys are still accepted but considered weak, and keys shorter than 1024 bits are ignored by Gmail and other major providers.
The record exists but its p= tag is empty, which deliberately disables that selector. It is normal for an old key after a rotation. If your platform still signs with that selector, its signatures will fail.
Yes — one per selector. It is common to have one per sending platform (for example Google Workspace for staff mail and an e-mail marketing tool for campaigns), each under its own selector.
No. Gmail, Yahoo and Outlook also expect SPF and a DMARC policy, aligned with the domain in your From address — and a clean list, because bounces and complaints hurt your reputation whatever your DNS says.
Usually minutes, but resolvers may cache a previous answer for up to its TTL. Our results are cached for 10 minutes, so wait a little before checking again.
A free account gives you 200 credits (10 for free-provider e-mails) to validate lists in bulk, through the REST API or in real time on your forms.
Create free account — 200 creditsNo credit card. Credits never expire.