--- title: "DKIM Checker: Selector, Key Size, Errors | Uptrack" description: "Free DKIM checker: enter a domain and selector to read the DKIM public key, see its type and size, and find revoked or test-mode keys." url: https://uptrack.app/tools/dkim-checker --- # DKIM Checker Use this DKIM checker to read the DKIM public key of a domain. Enter the domain and the selector your mail provider signs with, and see the key type, its size and any problem with the record. The Uptrack server reads the records through the public DNS resolver of Cloudflare and follows every include for you. A check can take a few seconds. Common selectors (hover for the provider). Your sender may use a different one. - google - selector1 - selector2 - k1 - s1 - default ## DKIM checker: how to find your selector The selector is chosen by the sender, so it differs between providers. Your provider shows it in its DKIM setup page. You can also read it in the headers of a message you sent: it is the s= value of the DKIM-Signature header. The key sits in a TXT record at selector.\_domainkey.yourdomain.com. The tool builds that name for you. ## DKIM record: what the result shows Key type RSA is supported everywhere. Ed25519 is newer and strong, but not every receiver checks it. Key size Use 2048 bits. A 1024-bit key still works but is no longer advised. Smaller keys are rejected by many receivers. Revoked An empty p= value means the key was withdrawn. Mail signed with it fails DKIM. Test mode The t=y flag marks the key as a test, so some receivers ignore failures. Remove it once signing works. ## DKIM key errors and fixes No DKIM key found The selector is wrong, or the record was never published. Check the selector with your mail provider. Invalid key The p= value was damaged when it was pasted. Copy it again, with no line breaks or extra characters. A long key split in two A 2048-bit key is longer than one 255-character string. Your DNS host must store it as two strings in one record. This tool joins them. ## Frequently asked questions ### What is a DKIM selector? A selector is a name that points to one DKIM key. A domain can have several, for example one per mail provider. The key is published at selector.\_domainkey.yourdomain.com. ### How do I find my DKIM selector? Look in your mail provider’s DKIM setup page, or open a message you sent and read the s= value in its DKIM-Signature header. Common examples are google, selector1 and k1. ### What DKIM key size should I use? 2048 bits. A 1024-bit key still works with most receivers but is no longer advised, and smaller keys are not safe. ### Why does the DKIM checker say no key was found? The selector may be wrong, the record may not be published yet, or a recent change may not have reached the resolver. Check the selector first, then wait for the TTL to pass and try again. ### Do I need DKIM if I have SPF? Yes. SPF breaks when a message is forwarded, while a DKIM signature survives. DMARC passes when either one passes and lines up with the From address, so using both is the safest set-up. ## More free tools [SPF CheckerRead an SPF record, follow every include and count its DNS lookups against the limit of 10.](https://uptrack.app/tools/spf-checker) [DMARC CheckerRead the DMARC policy of a domain and see what it does with mail that fails SPF and DKIM.](https://uptrack.app/tools/dmarc-checker) [TXT Record LookupRead the TXT records of a domain, including SPF, DKIM and DMARC.](https://uptrack.app/tools/txt-record-lookup) [Is this website down?](https://uptrack.app/tools/is-website-down) and [all free tools](https://uptrack.app/tools) ## Monitor this email DNS record every minute Uptrack checks your SPF, DKIM, DMARC and MX records on a schedule and alerts you when one changes or stops resolving. Plans from $3/mo, with a 30-day money-back guarantee. [See plans](https://uptrack.app/pricing) [How DNS monitoring works](https://uptrack.app/features/dns-monitoring)