Skip to content
Sign inGet started
Help · MoreDKIM checker: find your selector and check the key
Start here

DKIM checker: find your selector and check the key

Type a domain to find which DKIM selectors it publishes, which sender each belongs to, and whether each key is long enough. Or enter the selector you have.

On this page · 5 sections

What a DKIM selector is

A sender that signs your mail with DKIM publishes its public key in DNS, at a name made of a selector, _domainkey and your domain: google._domainkey.example.com. Each signed message says which selector to look up, so one domain can have a key for each service that sends for it, and a sender can switch to a new key under a new selector without breaking mail already in flight.

There's no list of a domain's selectors in DNS, so a checker can only try names. If yours isn't found, open a message you sent and look at its DKIM-Signature header: the selector is the value after s=, and the domain after d=.

The selectors the big senders use

google
Sender: Google Workspace
Record you add: A TXT record with the key. google is the default, and you can choose another. [4]
selector1, selector2
Sender: Microsoft 365
Record you add: Two CNAME records pointing at Microsoft. Only one signs at a time; the other is for the next key. [5]
k2, k3
Sender: Mailchimp
Record you add: Two CNAME records, to dkim2.mcsv.net and dkim3.mcsv.net. [6]
s1, s2
Sender: SendGrid
Record you add: Two CNAME records to your account's SendGrid host. [7]
cf2024-1
Sender: Cloudflare Email Routing
Record you add: A TXT record Email Routing adds for you. See SPF, DKIM and DMARC on Cloudflare.

A CNAME is fine: the checker follows it to the sender's key, as a receiver does. Checked on November 5, 2026: GitHub's google selector holds a 2048-bit key, and its s1 is a CNAME to SendGrid.

What the results mean

Strong key
What it means: RSA of 2048 bits or more, or an Ed25519 key. [2][3]
What to do: Nothing.
Works, but short
What it means: 1024-bit RSA. Signers must use at least 1024 bits and should use at least 2048. [2]
What to do: Ask the sender to rotate to 2048 bits, or generate a new key in its settings.
Too short
What it means: Under 1024 bits. Receivers must not treat signatures with these keys as valid, so DKIM fails. [2]
What to do: Replace the key now.
Revoked
What it means: The record's p= is empty, which means the key was withdrawn. [1]
What to do: Normal for an old selector. If it's the one your mail is signed with, publish the new key.
Testing
What it means: The record has t=y. Receivers must treat the mail no differently from unsigned mail. [1]
What to do: Remove t=y once signing works.

Where Ayoh fits

Ayoh sends through Cloudflare Email Service, which signs with keys Cloudflare publishes for you. When you connect a domain, Ayoh adds the records, and the checker above shows them.

Sources

Read November 5, 2026.

PreviousSPF too many DNS lookups? Count every includeNextDMARC record generator: build the record, step by step