DKIM Key Checker & Selector Prober
Probe over 45 industry-standard DKIM selectors, inspect public RSA/Ed25519 cryptographic keys, and confirm cryptographic strength.
How DKIM Key Checker Works
Selector Probing
Constructs FQDN queries `<selector>._domainkey.<domain>` for known and custom selectors.
Cryptographic Key Extraction
Decodes Base64 public key data to determine RSA/Ed25519 algorithms.
Bit Strength Evaluation
Checks if key length meets the modern RFC 8301 minimum requirement of 2048 bits.
RFC Engineering Standards
Every check performed by this tool adheres strictly to the Internet Engineering Task Force (IETF) Request for Comments:
- RFC 6376 (DomainKeys Identified Mail)
- RFC 8301 (Cryptographic Key Sizes)
Common Issues & How to Fix Them
If our diagnostic discovers configuration anomalies, use the remediation steps below:
Remediation: 1024-bit RSA keys are deprecated by modern mail receivers. Upgrade to a 2048-bit key in your email provider's console.
Remediation: An empty `p=` tag indicates a revoked key. Any emails signed with this selector will fail validation.
Frequently Asked Questions
What is a DKIM selector?
A selector is an identifier that points to a specific DKIM public key in DNS. It allows a domain to use multiple sending services (e.g. Google Workspace, SendGrid, Zendesk) simultaneously without key conflicts.
Why should I use 2048-bit keys instead of 1024-bit?
Advances in computing power have made 1024-bit RSA keys vulnerable to factorization. Major providers (including Google and Microsoft) recommend or enforce 2048-bit keys for sender authority.
Explore Other Free Diagnostic Tools
MX Record Lookup
Discover active Mail Exchanger (MX) hosts, priority rankings, IPv4/IPv6 addresses, and Null MX configurations in real-time.
SPF Record Validator
Validate Sender Policy Framework syntax, recursively trace include trees, and safeguard against the strict 10-lookup DNS limit.
DMARC Policy Analyzer
Audit DMARC records at _dmarc.<domain>, verify p=reject enforcement, check organizational inheritance, and inspect aggregate reporting.
Disposable Domain Checker
Check any domain against BounceLayer's in-memory list of over 100,000 throwaway, temporary, and 10-minute inbox services.
Email Checker
Instant keyless diagnostic inspecting RFC 5322 syntax grammar, authoritative MX records, role accounts, and free email providers.
Blacklist Checker
Scan IPv4 addresses and domains against authoritative DNS blocklists (Spamhaus, Barracuda, SORBS, SURBL, SpamCop) in parallel.
Verify Real Mailbox Existence in Real-Time
DNS tests only tell you if a server is reachable. BounceLayer's API connects directly to recipient mail servers via port 25 SMTP handshakes to confirm exact mailbox existence in under 140ms.