DKIM checker
Use this DKIM checker to read the public key for your selector, or to try the selectors of common mail providers. See the key type, size and flags, with a fix for each problem.
Free, no account. Ten checks per hour, shared by our DKIM, blacklist, MTA-STS and BIMI checkers.
Email deliverability checks
Check the sending identity, domain policy, receiving servers and an actual received message together. These checks explain configuration; they cannot certify delivery to an inbox.
- SPF
- Authorize your sending IP and trace the DNS lookup budget.
- DMARC / DKIM
- Check policy, alignment settings, reporting permissions and public keys.
- MX
- Inspect incoming servers, addresses, reverse DNS and the public blocklist.
- Email headers
- Read actual receiver results, forwarding assertions and hop delays locally.
- DKIM
- Read the public key for a selector, or try common provider selectors.
- Blocklists
- Check mail server addresses on DNS blocklists, with removal steps.
- MTA-STS
- Check the TLS policy for incoming mail, its MX match and TLS reports.
- BIMI
- Check the BIMI record, the SVG logo, the certificate and DMARC readiness.
Google and Yahoo bulk sender requirements
Requirements checked 2026-10-12. Google applies its bulk rules above 5000 messages per day to personal Gmail accounts. Yahoo describes bulk senders without publishing the same numeric threshold.
- Publish SPF and sign with DKIM. Publish DMARC with at least p=none, and align the visible From domain with a passing SPF or DKIM identity.
- Use valid forward and reverse DNS and correctly formatted messages. Google also requires TLS transport. Keep reported spam rates below 0.3 percent.
- Marketing and subscribed messages need one-click unsubscribe headers plus a visible unsubscribe link. Honor unsubscribe requests within two days.
- Google requires RSA DKIM keys of at least 1024 bits and recommends 2048 bits. A DNS key check does not prove that outgoing mail is signed.
Spam rate, unsubscribe behavior and real SMTP TLS are outside a DNS check. Verify them with your mail service and a received message.
Google sender guidelinesYahoo sender requirementsYahoo bulk sender definition
A DKIM checker reads the public key a domain publishes at selector._domainkey. Enter your selector, from the s= tag of a DKIM-Signature, or let us try the documented selectors of common mail providers. You see the key type, size, flags and fixes. DNS cannot list selectors, so a selector not found here does not prove DKIM is missing.
How to use this checker
- Find your selector
- Open a message you sent and show its original headers. In the DKIM-Signature field, s= is the selector and d= is the domain. Leave the selector blank to try common providers.
- Read the key
- We read the TXT record at selector._domainkey.example.com and explain each tag: key type, size, flags, hash and service. An empty p= means the key was revoked.
- Fix what is flagged
- Replace RSA keys under 2048 bits through your mail service, remove t=y once signing works and keep one record per selector. Then send a test message and read its DKIM result.
Questions about this checker
Check your business in AI answers
Email records protect your name in the inbox. The free AI visibility scan shows how ChatGPT and other assistants describe your business.