DKIM Validator
Validate DKIM records with intelligent selector auto-discovery.
What is DKIM?
DKIM (DomainKeys Identified Mail) is an email authentication method that allows senders to digitally sign messages, helping receivers verify authenticity.
Auto-Discovery
This tool automatically scans common DKIM selectors (default, google, selector1, selector2, k1, etc.) to find your DKIM configuration without requiring manual selector input.
DKIM Validator — Check Email Signature Authentication
DKIM validation queries the DNS TXT record at {selector}._domainkey.{domain} to verify that the public key exists and is valid for email signature verification.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outbound email. Receiving servers use the public key from DNS to verify the signature, confirming the email was not modified in transit. Our validator auto-discovers common selectors and validates the public key format, key length, and record integrity.
What is DKIM?
DKIM is an email authentication method that uses public-key cryptography to sign outbound messages. Receiving servers verify the signature against the public key in DNS to confirm message integrity.
When a mail server sends an email with DKIM, it creates a hash of the message content and signs it with a private key. The signature appears in the DKIM-Signature header. Receiving servers query DNS for the public key and use it to verify the signature. If the email was modified in transit, the signature fails.
What is a DKIM Selector?
A DKIM selector identifies which DKIM key to use when multiple keys are published. It appears in the DKIM-Signature header as s=selector and is required to look up the correct DNS TXT record.
Selectors allow a domain to publish multiple DKIM keys simultaneously — for example, one for the primary mail system and another for a marketing platform. Common selectors include 'default', 'google' (Google Workspace), 'selector1' / 'selector2' (Microsoft 365), and 'mail'. Our tool scans common selectors automatically; if yours isn't found, enter it manually.
DKIM Key Length: 1024-bit vs 2048-bit
DKIM supports RSA key lengths from 1024 to 2048 bits. 1024-bit is the current minimum; 2048-bit provides stronger security. Keys below 1024 bits are considered insecure and should be replaced immediately.
Older DKIM implementations used 512 or 768-bit keys, which are now weak and should be replaced. The current recommendation is 2048-bit RSA. Google Workspace and Microsoft 365 now default to 2048-bit. Our validator reports the key length and flags keys below 1024 bits as insecure.
Auto-discover DKIM selectors and validate email signature authentication for any domain.
Validate DKIM nowUse Cases
Email administrators validate DKIM to confirm that new email providers have correctly configured signing. DevOps teams validate DKIM during DNS migration to ensure authentication continuity. Marketing teams verify that ESP DKIM selectors are active before major campaigns. Security teams audit all authorized senders for a domain.