DKIM (DomainKeys Identified Mail) is an email authentication method that uses cryptographic signatures to verify that an email was sent by the domain it claims to be from and hasn't been altered in transit.

What is a DKIM selector?

A DKIM selector is a string used to locate the DKIM public key in DNS. The full lookup is selector._domainkey.domain. Common selectors include 'default', 'google', 'selector1', 'k1', etc. Each email service provider uses its own selectors.

What key size should DKIM use?

DKIM keys should be at least 2048 bits for security. 1024-bit keys are still functional but considered weak. Keys shorter than 1024 bits should be replaced immediately.

How do I find my DKIM selector?

Check the DKIM-Signature header in any email sent from your domain. Look for the 's=' tag - that's your selector. Common values: 'google' (Google Workspace), 'selector1'/'selector2' (Microsoft 365), 'k1' (Mailchimp), 'mail' (generic).

What does a CNAME in DKIM mean?

Many email service providers (Brevo, Mailchimp, SendGrid) use CNAME records to point your DKIM selector to their own DNS. This is normal and allows the ESP to manage DKIM key rotation automatically.

Free DKIM Record Checker

🔑

🔒

🔄

SPF Checker DMARC Checker BIMI Checker Blocklist Checker Header Analyzer