Skip to content
PixelPrivate
Log inFree trial
Menu
Attack Surface & ExposureEmail & Brand ProtectionData ExposureTrust & CompliancePolicy & AccessPlatform overviewCEOs of growing companiesCFOs and finance leadersManufacturingSaaSE-commerceHealthcare and clinicsProfessional servicesAgencies and MSPsCyber-insurance readinessReal casesScenariosFree toolsLearnPricingLog inStart 14-day free trial

Free tool

DKIM checker

DKIM signs your outgoing email so receivers can verify it was not altered and really came from your domain. Unlike SPF and DMARC, DKIM records live at a “selector” that only your email provider knows, so no outside tool can list them all. This checker tries the selectors most providers use and is honest about what that does and does not prove.

Your email provider shows the selector on its DKIM page. Separate up to 5 with commas. Without one, PixelPrivate can only try common names and will say “not verified” rather than “missing”.

No credit card. Only scan domains you own or are authorized to assess. PixelPrivate performs passive, public checks only.

What this checks

  • Keys at 23 commonly used selectors, plus the one your mail provider suggests
  • Selectors you enter yourself (up to 5): the record at selector._domainkey.yourdomain
  • Version, key type, key length, revoked (empty p=), testing mode and malformed records
  • CNAMEs that hand the key to your email provider

How to use it

  1. Find your DKIM selector in your email provider’s admin console (look for “DKIM” or “domain authentication”).
  2. Enter your domain and the selector.
  3. If the record is missing or malformed, publish the record your provider shows, enable signing and send a test message.
  4. Without a selector the result is “not verified”, which is not the same as “missing”.

Methodology and limitations

PixelPrivate checks the published record. It cannot see your outgoing mail, so it cannot prove that mail is signed with the key. Without a selector, a custom selector will not be found: treat “not verified” as “unknown”, never as proof DKIM is off. PixelPrivate performs passive checks against publicly visible configuration only. It does not test for exploitable vulnerabilities, so a clean result is not a guarantee of security. Read the full security methodology.

Key terms

  • DKIM — DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outgoing email so receivers can verify it came from your domain and was not altered in transit..
  • DMARC — DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM checks..

Frequently asked questions

Where do I find my DKIM selector?

In your email provider’s admin console on the DKIM or domain authentication page (for example “selector1” and “selector2” for Microsoft 365, “google” for Google Workspace by default). It is the part before ._domainkey in the DNS record name.

Why does the checker say it cannot find my DKIM key?

DKIM keys are published under a provider-specific selector name. If yours is not one of the common ones, it cannot be discovered from outside. Check your email provider’s settings.

What key size should I use?

2048-bit RSA is the common recommendation today.

Monitor this domain continuously with PixelPrivate.

Create a free account to re-check automatically, keep your DKIM selectors, and get alerted when SPF, DKIM, DMARC or MX records change.

Create free account

Related tools

Related guides