DKIM checker

Look up the DKIM record a domain publishes under a selector, and see whether the key is valid, long enough and live. Nothing you enter is stored.

The domain the mail is sent from, for example yourcompany.com

The label in the DKIM-Signature header of a message, shown as s=

Common selectors

Result

Enter a domain and a selector, and the record appears here.

What this covers in your audit

Message signing supports SOC 2 Trust Services Criteria CC6.6 and CC6.7, and ISO 27001:2022 Annex A 8.20 and A 5.14.

DKIM speaks to the integrity of messages in transit. A signature that verifies shows the message was sent by a system holding the domain's private key and was not altered on the way.

It contributes evidence toward those controls rather than satisfying them. An auditor will also look at how the private key is stored, who can reach it, and whether selectors are rotated.

What you need to know

What a selector is

A selector is a label that lets one domain publish more than one DKIM key. The record lives at <selector>._domainkey.yourdomain.com, and every signed message names its selector in the signature header so the receiver knows which key to fetch. This is why a check needs both a domain and a selector: there is no way to list them all from outside.

How to find your selector

Open a message your domain sent, view the original or the full headers, and look in the DKIM-Signature line for s=. That is the selector. If you cannot get at a message, try the one your platform uses: Google Workspace is usually google, Microsoft 365 is selector1 and selector2, Mailchimp is k1, Postmark is pm, Zendesk is zendesk1, and many self-hosted servers use default.

Why 2048 bits matters

The strength of a DKIM signature comes from the key behind it. A 1024-bit RSA key is within reach of a well resourced attacker, and anyone who breaks it can sign mail that passes both DKIM and DMARC. 2048 bits is the current recommendation and is supported everywhere. Ed25519 is shorter and stronger again, but support is not yet universal, so most domains publish RSA.

A missing record is not always a missing key

Nothing found at a selector usually means the selector is wrong rather than that the domain has no DKIM. Check the headers of a real message before concluding that signing is not set up.