DKIM Checker
Is your mail actually signed?
A free DKIM checker for UK businesses. You don't need to know your selector — paste your domain and we probe 23 common ones (google, selector1, k1 and friends), find every published key, and grade the strongest: key length, syntax, and whether it's live or revoked. SPF and DMARC checked in the same pass.
Check your keys
What we grade
Three things
about your keys
DKIM lives at selector._domainkey.yourdomain.co.uk — a public key your mail server's signature is verified against. The catch: nothing warns you when it's missing. Mail still sends; it just sends unsigned.
- № 01
Whether a key exists at all
The most common UK SME finding is simply: no DKIM record. Google Workspace and Microsoft 365 generate keys for you, but publishing the TXT record in your DNS is a manual step — and it's the step that gets skipped during migrations. The business sends unsigned mail for years and only finds out when Gmail starts demoting it.
- № 02
Key length — 2048 minimum
1024-bit RSA keys were the default for years and still work, but they're below current guidance — 2048-bit is the modern minimum and what Workspace and 365 issue today. We measure the key you've actually published, not the one your provider says it gave you; old selectors with short keys linger in DNS long after upgrades.
- № 03
Every sender that signs
Each service that sends as your domain signs with its own selector — Workspace uses
google, 365 usesselector1andselector2, Mailchimp usesk1. A service whose selector isn't published sends mail that fails DKIM — invisible today, spam-folder material the day your DMARC policy tightens.
FAQ
Common
questions
- Q1
What is a DKIM selector and how do I find mine?
The selector is the label your mail service signs with — it points receivers to the right public key when one domain has several. You can find it in the s= tag of the DKIM-Signature header on any email you've sent, or just run this checker: we probe the 23 selectors that cover the mail services UK SMEs actually use.
- Q2
I'm on Google Workspace / Microsoft 365 — surely DKIM is automatic?
The key generation is automatic; the publishing isn't. Both platforms require you to add their TXT (or CNAME) record at your DNS provider and, in Workspace's case, click "start authentication". Skip that and mail goes out unsigned indefinitely — one of the most common findings on UK SME domains we audit.
- Q3
Is a 1024-bit DKIM key still acceptable?
It still verifies, but it's below current guidance and some receivers score it down. 2048-bit is the modern minimum and what every major provider issues today. If your published key is 1024-bit, rotate it — generate a new key in your mail platform, publish the new record, and remove the old selector once mail in transit has cleared.
- Q4
Does DKIM stop my emails going to spam?
It's one of the three requirements. Gmail and Outlook expect SPF, DKIM and DMARC together — DKIM matters especially because it survives forwarding, which SPF doesn't. Signed mail from a domain with an enforcing DMARC policy is the strongest deliverability position a small business can hold.
The other two records