Tools
Check a domain’s DKIM key
Validate the public key published for a DKIM selector and review its algorithm, key size, testing mode, and revocation status.
Published record
- Public key
- Key size
- Revoked
- Testing mode
- Hash algorithms
Issues and recommendations
How DKIM keys are published
A sending service signs messages with a private key while receivers fetch the matching public key from DNS.
- Selector
- The selector identifies which key to read at selector._domainkey.domain.
- Key strength
- RSA keys should be at least 2048 bits. 1024-bit keys are deprecated.
- Revocation
- An empty p= tag revokes the selector and tells receivers not to use that key.