Probe 36 known DKIM selectors and confirm signing is live.
Probe 36 known DKIM selectors (google, selector1/2, k1, s1/s2, amazonses, brevo1/2, protonmail…) in parallel. If one publishes a key, DKIM signing is active — and both Gmail and Outlook treat unsigned mail with deep suspicion. Not sure what a selector even is? Start here.
DNS has no way to list the DKIM selectors a domain publishes, so this probes a curated list and reports every key it finds. A result means signing is live for that selector.
Nothing found does not always mean DKIM is missing. Some providers mint a random per-account selector that no probe list can guess — Amazon SES BYODKIM among them. In that case read the s= tag off a message you actually sent.
DKIM public keys are published under a selector you choose (or your provider chooses), at selector._domainkey.yourdomain.com. There's no DNS mechanism to list every selector for a domain, so this tool probes the 36 selectors we track — covering Google Workspace, Microsoft 365, Mailchimp, SendGrid, Amazon SES, Brevo, Zoho, Proton and the generic self-hosted defaults — and reports any that resolve.
Not necessarily. It means none of the 36 selectors we probe published a key. Some providers mint a random per-account selector that no probe list can guess (Amazon SES BYODKIM does this). Read the s= tag off a message you actually sent, or check your provider's dashboard for the exact name.
SPF authorises sending IPs and breaks on forwarding; DKIM cryptographically signs the message itself and survives forwarding. They're complementary — DMARC requires at least one of them to pass and align with your visible From: domain.
Yes, and you usually should. Each sending service publishes its own selector, so a domain that sends from Google Workspace plus a transactional provider will legitimately have two or more live selectors. This checker reports every common one it finds.
Use 2048-bit keys where your provider supports them — 1024-bit is still widely accepted but increasingly considered weak. The key length is set when your ESP generates the record, not something you change in this checker.
During domain setup, every time you add a new sending service, and as part of pre-send QA. A missing or mis-published DKIM key is one of the most common reasons mail lands in spam at Gmail and Outlook.
SieveGuard's Domain Health add-on monitors DKIM signing on every domain you onboard, watching for rotated or removed keys, and surfaces a pass/fail badge alongside SPF and DMARC so nothing silently stops signing.