DKIM record checker

Find published DKIM keys for a domain across 70+ common selectors, or enter your own selector, and verify key strength.

Free, instant, no signup. Results include SPF, DKIM and DMARC together.

How DKIM lookup works

DKIM keys live at <selector>._domainkey.<domain>. The selector is chosen by whoever signs the mail, so there is no way to list them all from DNS. This tool probes the selectors used by Google Workspace (google), Microsoft 365 (selector1, selector2), Mailchimp (k1), SendGrid (s1, s2, smtpapi), HubSpot (hs1, hs2), Zendesk, Mandrill, Postmark, Amazon SES and others. For each key found it parses the public key and reports the RSA modulus length, revoked keys (empty p=) and testing flags.

To check a specific selector, use the URL form /check/yourdomain.com?selectors=mysel, or add selectors permanently to a monitored domain.

Ways out of a bad result

Remove what you stopped using. Most records over the limit include a tool that was cancelled years ago.

Flatten the noisy ones. Swap a heavy include for its IP ranges, and monitor them.

Use subdomains. Send marketing from a subdomain with its own SPF and stop crowding the root.

Monitoring re-counts this every day, so the next include someone adds does not sneak past 10.

Recently graded

Public checks from the last few days. Every report is re-measured from DNS when opened.

live

DomainSPFDKIMDMARCGrade

gandi.net2 lookupsnot foundp=noneC zoom.us6 lookups2048-bitp=rejectA skype.com2 lookupsnot foundp=rejectB shopify.com4 lookups2048-bitp=rejectA bing.com1 lookupsnot foundp=rejectB ebay.com10 lookups2048-bitp=rejectA facebook.com1 lookupsnot foundp=rejectB msn.com7 lookups2048-bitp=noneB