Can a DKIM selector be discovered from a domain alone?

Not reliably. DKIM selectors are chosen by each signer and DNS does not publish a complete selector list. A delivered message's DKIM-Signature header provides the s selector and d signing domain actually claimed by that message.

Does a published DKIM public key prove that DKIM works?

No. A DNS key can be parsed, but only verification of a representative signed message can show whether the signer has the matching private key and whether that signature passes.

What RSA key size should DKIM use?

RFC 8301 requires at least 1024-bit RSA keys and recommends 2048 bits. Rotate keys through the signing provider so public DNS and private-key use change together.

Can this DKIM inspector change DNS?

No. It reads public DNS records for the domain and selector. It cannot change the signing service, private key or DNS configuration.

Public-key evidence · read-only DNS

Free DKIM inspector and public key checker.

Check the selector a message used, validate its public-key material and understand key strength, restrictions and DNS aliases. If you do not know the selector, run a clearly bounded candidate search.

Inspect a DKIM key

Inspect a selector

Start with message evidence when you have it.

The most reliable input is the d= signing domain and s= selector from a representative delivered message.

Do not know your selector?Find d= and s= privately from an email header.

Public DNS check. We look for the selector's public key record and explain what it contains. Nothing is changed.

Read the result correctly

A public key is evidence—not a delivery verdict.

A message reveals the real selector

The DKIM-Signature header carries the signer's d= domain and s= selector. DNS has no universal selector index.

Private-key control is untested

A valid public key cannot prove that a sender controls the matching private key or that current messages use it.

DMARC alignment is separate

Even a passing DKIM signature supports DMARC only when its authenticated signing domain aligns with the visible From domain.

No inbox-placement promise

DKIM is one signal. Reputation, content, recipient policy, SPF, DMARC and other factors also affect handling.

Standards used

Current rules, visible sources.

The checker follows the DKIM base specification, current algorithm and key-size guidance, the Ed25519 extension, and the IANA registry.

RFC 6376DKIM signatures and key records RFC 8301RSA strength and SHA-256 requirements RFC 8463Ed25519-SHA256 for DKIM IANA DKIM parametersCurrent tags, algorithms and statuses

DKIM questions

What this public check can establish.

Can the tool discover every selector from a domain?

No. Selectors are arbitrary names chosen by signers, and DNS does not publish a complete directory. Automatic mode checks a bounded set of common and provider-informed candidates only.

How do I find the right DKIM selector?

Inspect a representative delivered message. Its DKIM-Signature header contains the s= selector and d= signing domain. You can use our browser-only email header analyser without uploading the header.

Does a valid public key prove DKIM works?

No. It confirms that the DNS value can be parsed. Verify a representative message to establish whether the signature passes and the signer controls the corresponding private key.

Is a 1024-bit RSA key acceptable?

RFC 8301 sets 1024 bits as the minimum and recommends 2048 bits. Plan rotation through the email provider rather than replacing key material manually.

Does DKIM passing mean DMARC passes?

Not necessarily. A DKIM result supports DMARC only when the signing domain aligns with the visible From domain. SPF can provide a separate aligned path.