DKIM Inspector
Scan a domain for published DKIM keys across common selectors — or look up a specific selector — and analyze key type, length and flags.
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every outgoing message. The receiving server fetches the matching public key from your DNS — at <selector>._domainkey.<yourdomain> — and verifies that the message really came from your infrastructure and was not modified in transit. Without DKIM, you cannot achieve DMARC alignment for mail forwarded through mailing lists, and providers like Gmail treat unsigned bulk mail with increasing suspicion.
The catch is that DKIM keys live behind selectors, and every provider names theirs differently: Google Workspace uses "google", Microsoft 365 uses "selector1" and "selector2", Mailchimp uses "k1", and so on. There is no way to enumerate all selectors of a domain from the outside — you have to know what to ask for. This inspector checks the ten most common selectors used by major providers in one pass, and lets you add your own selector if your provider uses a custom one.
For every key found, we decode the actual public key and report its type and length. RSA keys under 1024 bits are flagged as critical: they can be factored cheaply enough that an attacker could sign mail as you, and most receivers reject them anyway. 1024-bit keys still work but 2048-bit is the standard you should rotate to. We also flag keys in test mode (t=y) — a setting that tells receivers to ignore signature failures and is often left on by mistake after setup — and revoked keys with an empty p= tag.
If no keys turn up, DKIM is most likely not enabled at your email provider — it usually takes two clicks and one DNS record to fix, and it is the single best deliverability improvement most domains can make.