v=DKIM1Version; when present it must come first. All tools
DELIVERABILITY TOOL / 10DKIM record
DKIM record
checker
Inspect the key a receiver actually retrieves. Resolve selector aliases, parse every tag, measure RSA strength, and separate a published record from a working signature.
- Live DNS and draft mode
- RSA and Ed25519 keys
- RFC-aware diagnostics
Selector input
TXT QUERY
default._domainkey.emailbump.comLive lookups use Google Public DNS over HTTPS with EDNS client subnet disabled. The queried selector goes to Google’s resolver. Draft record contents stay in your browser.
Start with the selector on a real message.
The d= and s= tags identify one DNS name. A domain can publish several valid selectors at once, so guessing “default” cannot prove another selector is missing.
DKIM-Signature: … d=example.com; s=selector1; …selector1._domainkey.example.comD= DOMAIN + S= SELECTOR
DKIM publishes keys at a message-specific DNS name.
A receiver reads the signing domain and selector from the DKIM-Signature header, constructs selector._domainkey.domain, and retrieves the public key. Selectors allow a domain to rotate keys or delegate different sending systems without replacing one global record.
s=selector1+_domainkey+d=example.comselector1._domainkey.example.comCRYPTOGRAPHIC FLOOR
RSA needs at least 1,024 bits; 2,048 is the recommendation.
RFC 8301 requires RSA signing keys of at least 1,024 bits and recommends at least 2,048. It also retires RSA-SHA1: signers must use RSA-SHA256 and verifiers must not treat RSA-SHA1 signatures as valid. RFC 8463 adds Ed25519-SHA256 with a fixed 256-bit public key.
< 1,024-bit RSABelow RFC floorInvalid
1,024-bit RSAMinimumRotate forward
2,048-bit RSARecommendedGood default
ROTATION WITHOUT A CLIFF
Publish, switch, observe, then retire.
Create a new selector and publish its public key before signing with the new private key. Wait for DNS propagation, switch the signer, verify real messages, and retain the old public key long enough for delayed mail and queued retries. Revoke or remove the old selector only after the transition window.
- 01Publish
Add the new selector and wait beyond relevant caches.
- 02Switch
Configure the signer to use the matching private key.
- 03Verify
Inspect delivered Authentication-Results and DKIM-Signature headers.
- 04Retire
Remove or revoke the old selector after delayed messages age out.
COMMON QUESTIONS
DKIM record checker FAQ.
Where do I find the selector?+
Open a message’s original headers and find the DKIM-Signature field. Use the value after s=. Use the d= value as the signing domain. Provider documentation may also list the selector, but a real message shows what was actually used.
Does a valid record mean DKIM passes?+
No. A pass requires a message signed by the matching private key, correct canonicalization and body hash, intact signed content, and successful verification by the receiver.
Can a domain have several selectors?+
Yes. Multiple selectors are normal for rotation, vendors, regions, or separate streams. The checker evaluates one selector at a time.
Why does the selector point to a CNAME?+
A CNAME can delegate key publication and rotation to a sending provider. Confirm that the target is expected and that the provider still belongs in your mail inventory.
Is DKIM the same as DMARC alignment?+
No. DKIM validates a signature from d=. DMARC can use that result only when the authenticated d= domain aligns with the visible From domain under the applicable alignment mode.
PRIMARY REFERENCES
AUTHENTICATION IS THE START
Send with evidence attached.
Authenticate every sending domain, separate mail streams, and inspect delivery activity in one workspace.
Start for free