Free DKIM record check
This free DKIM checker finds your signing key, checks it’s complete and strong enough, and tells you what to fix. Leave the selector box empty: we try over 50 names email providers use. Know yours? Add it.
Example result for yourcompany.com
Found 2 signing keys. The s1 key is 1024-bit; 2048-bit is the standard now, and some inboxes trust weaker keys less.
How to fix it
Switch to a 2048-bit key. In SendGrid, set up a new authenticated domain with a 2048-bit key, publish the records it gives you, then remove the old ones.
Keys found
| Selector | Usually used by | Key | Result |
|---|---|---|---|
google | Google Workspace | RSA, 2048-bit | Pass |
s1 | SendGrid | RSA, 1024-bit | Weak key |
Record for the google selector (at google._domainkey.yourcompany.com)
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvJ3m…IDAQAB
Checks
DKIM proves an email really came from your domain and wasn’t changed on the way. Gmail, Yahoo and Outlook require it from bulk senders, and DMARC relies on it.
01
Google Workspace, Microsoft 365 or your sending tool adds a hidden signature to every message, made with a private key only it holds.
02
A TXT or CNAME record at selector._domainkey.yourdomain publishes the matching public key for anyone to read.
03
Gmail, Yahoo and Outlook fetch the key and check the signature. A match proves the email came from you and wasn’t changed.
The checker tries the common ones for you. If yours isn’t found, open an email you sent, choose “Show original” (Gmail) or “View source”, and look for s= in the DKIM-Signature line. The word after s= is your selector.
| Service | Selector to try |
|---|---|
| Google Workspace | google |
| Microsoft 365 | selector1, selector2 |
| Mailchimp | k1 |
| SendGrid | s1, s2 |
| Brevo | brevo1, brevo2 |
| Fastmail | fm1, fm2, fm3 |
| Proton Mail | protonmail, protonmail2, protonmail3 |
| iCloud Mail | sig1 |
A DNS record that publishes the public key for your email signatures. Inboxes use it to check that a message really came from your domain and wasn’t altered.
Either DKIM isn’t switched on yet, or your provider uses a selector name we don’t try. Find the selector in an email you sent (look for s= in the DKIM-Signature line) and enter it.
It still works, but 2048-bit is the standard now and some inboxes trust 1024-bit keys less. Most providers let you switch with a new record.
Yes. Each service signs with its own key and selector, so set DKIM up in your inbox provider and in every sending tool, newsletter and helpdesk you use.
Step-by-step fix guides: How to set up DKIM in Google Workspace · How to set up DKIM in Microsoft 365 · DKIM fail and “body hash did not verify”
