What DKIM does
DKIM signs each message with a private key; the public key lives at selector._domainkey.domain. Receivers verify the signature and, for DMARC, check that the signing domain aligns with the From header. Unlike SPF it survives forwarding.
Reading the result
- Keys under 1024 bits are rejected by receivers (RFC 8301); 2048 bits is the baseline.
- t=y means testing mode; receivers may treat the signature as unverified.
- An empty p= means the key was revoked: correct for a retired selector once no mail signed with it is in flight.
- A CNAME means your provider hosts and rotates the key (Microsoft 365, SendGrid, Amazon SES and others).
- Ed25519 keys must be the bare 32-byte key; the DER (SPKI) form some tools produce fails verification.
Need a key? Use the DKIM key generator. Want to know if a real message verifies? Paste it into the DKIM signature validator.
DKIM checker: questions
How do I find my DKIM selector?+
Look at the DKIM-Signature header of a message you sent: s= is the selector and d= the signing domain, and the public key lives at selector._domainkey.domain. Google Workspace uses google by default, and Microsoft 365 uses selector1 and selector2. Leave the selector field empty and the checker tries more than 60 provider-default and common selectors.
Why is my DKIM record not found?+
Most often because your provider uses a selector the scan does not cover; enter it in the selector field. Other causes: the DNS panel appended your domain a second time, creating s1._domainkey.example.com.example.com; the new record has not reached resolvers yet; or DKIM is not switched on at the provider, so the CNAME you published points at a name with no key.
Is a 1024-bit DKIM key still safe?+
It still verifies, but it is below the recommended strength. RFC 8301 makes 1024 bits the minimum receivers accept and says signers should use at least 2048 bits, today's baseline. Rotate to a 2048-bit key under a new selector; if your DNS host limits TXT strings to 255 characters, enter the key as several quoted strings in one record.
What does t=y mean in a DKIM record?+
It puts the key in testing mode. RFC 6376 §3.6.1 tells verifiers to treat mail signed with a testing key no differently from unsigned mail, so a receiver following the RFC gives the signature no weight. Remove t=y once signing works; the checker shows the corrected record with the same key.
Why is my DKIM record a CNAME?+
Because your email provider hosts the key for you. Microsoft 365, SendGrid, Amazon SES and other services have you publish a CNAME at selector._domainkey that points to a record they control, so they can rotate the key without DNS changes on your side. The checker follows the CNAME, reads the key behind it and names the provider.
Can a domain have more than one DKIM key?+
Yes, one per selector. Each service that signs for the domain, such as your mailbox provider, a newsletter tool and a helpdesk, can publish its own key under its own selector, and you can add a new key before retiring an old one. Each selector name should hold exactly one TXT record; RFC 6376 leaves the result undefined when there are several.