DKIM checker
Find a domain’s DKIM keys at the selectors mail services use, or at your own, with each key’s type and its length in bits.
What does it check?
No rule in the rulebook covers this, so here is what it reads.
- The selectors common senders use, or the one you give
- Each public key found, its type and length
- Whether a key is revoked
Questions
What is a DKIM selector?
The name a key is kept under, at selector._domainkey.yourdomain. Each sending service has its own.
How long should a DKIM key be?
2048 bits. 1024 still works but is weak.
How do I find my selector?
Open a message your domain sent and read its DKIM-Signature header: the s= value is the selector.
The address
s1- Selector, named by the sender
._domainkey.- Always this
example.com- The domain
The TXT record there
v=DKIM1- Version
k=rsa- Key type
p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu3x…IDAQAB- The public key, 2048 bits
In a message’s headers
d=example.com- The domain that signed
s=s1- The selector to look up
Each sending service signs with a selector of its own. A 2048 bit RSA key is the length to use; 1024 still works and is weak.
The whole site
One page is one part. A read checks every page against the whole rulebook and says what to fix first.
Read a whole site