Free DKIM Record Checker & Key Validator
Inspect published DomainKeys Identified Mail (DKIM) public keys, test selector resolution across major SaaS email providers, and verify RSA cryptographic key strength in seconds with zero waiting queues. DKIM is the industry standard for asymmetric email authentication. When your outbound mail server transmits a transactional receipt, newsletter, or user invitation, it attaches a private digital signature to the message headers. Recipient mail servers at Google Workspace, Microsoft 365, and Apple Mail use your published DNS public key to verify that the message content was not tampered with or modified during transit.
Our free DKIM inspector scans popular email vendor selectors (including Google Workspace (google), Microsoft 365 (selector1, selector2), SendGrid (s1, s2, smtp), and Postmark) or evaluates any custom selector specific to your infrastructure. Pingzo validates the public key data (p= tag), detects explicit key revocations (empty p= tags per RFC 6376), checks key bit lengths to warn against outdated 1024-bit RSA keys, and tests for misleading wildcard DNS configurations.
Unlike legacy command-line tools that require manual dig commands for each individual selector, Pingzo provides automated concurrent lookups and clear actionable diagnostics. Simply enter your apex domain and optional custom selectors below to test your cryptographic deliverability health in real time. Because SaaS vendors frequently rotate DKIM keys or DNS changes can inadvertently drop critical CNAME records, pair your manual checks with Pingzo's continuous 24/7 deliverability monitoring to receive instant multi-channel alerts via WhatsApp, Telegram, Slack, and Discord whenever your DKIM signatures break.
Understanding DKIM Selectors & Cryptographic Best Practices
Unlike SPF and DMARC which have predictable apex hostnames, DKIM records require a selector prefixto locate the public key. Below are critical security considerations when configuring DKIM:
Modern cryptographic standards require at least 2048-bit RSA keys. Older 1024-bit keys can be cracked using cloud computing factorization. Inbox providers like Google and Yahoo increasingly flag 1024-bit signatures as weak.
According to RFC 6376, publishing an empty p= tag explicitly informs receivers that the key is revoked. Any incoming email signed by this key is immediately treated as unauthenticated.
Frequently Asked Questions
What is a DKIM record and how does it protect email delivery?
DomainKeys Identified Mail (DKIM) is an asymmetric cryptographic authentication standard. The sender signs outgoing emails with a private key, and receiving mail servers verify the digital signature using the public key published in your domain DNS at selector._domainkey.yourdomain.com. Valid DKIM proves the message was neither forged nor tampered with in transit.
What is a DKIM selector and where do I find mine?
A DKIM selector is a unique string that points to a specific public key. Your email provider specifies the selector in its DKIM configuration (e.g. google._domainkey for Google Workspace, selector1._domainkey for Microsoft 365, or k1._domainkey for SendGrid). You can also find your active selector by inspecting the DKIM-Signature header of any email sent from your domain (look for s=).
Why does Pingzo warn against 1024-bit DKIM keys?
Modern cryptographic standards require at least 2048-bit RSA keys for DKIM. 1024-bit RSA keys are susceptible to factoring attacks, and major mailbox providers increasingly flag them as weak or deprecated.
What does an empty p= tag mean in a DKIM record?
According to RFC 6376, an empty public key tag (p=) explicitly revokes the key. If a mail server receives an email signed by a revoked key, it treats the DKIM signature as invalid, failing authentication.
How does Pingzo continuously monitor DKIM keys?
In Pingzo’s Email Health dashboard, you can save custom selectors for your domain. Pingzo audits these selectors every 24 hours, alerting your team via WhatsApp, Telegram, Slack, or Discord if a public key disappears, rotates unexpectedly, or becomes revoked.
Related Developer Tools
SPF Record Checker
Validate SPF syntax, evaluate 10-lookup limits, and detect PermErrors.
DMARC Policy Checker
Audit DMARC enforcement tiers (reject/quarantine) and rua mailboxes.
SPF & DMARC Generator
Generate compliant SPF and DMARC TXT records for email providers.
DNS Records Lookup
Query A, AAAA, MX, CNAME, TXT, and NS records directly from root servers.