Signatures and keys
DKIM signs parts of an email. Receivers can verify a signature with a public DNS key. The key belongs to the signing domain d=; the selector s= identifies a name below _domainkey. Our domain check inspects the key without evaluating an email.
Finding the correct selector
Use s= from the DKIM-Signature header of an actual sent message or your sending service’s instructions. Enter only the selector, such as default, not the entire DNS address. Different services may use different selectors. A missing record at one name therefore does not establish that DKIM is absent altogether.
Keys and status indicators
RSA below 1024 bits does not meet current minimum requirements; at least 2048 bits is recommended. Ed25519 is another DKIM algorithm. An empty p= revokes a key. The indicators distinguish a readable key, guidance and detected issues. They validate neither an actual signature nor DMARC alignment.
Practical next steps
Compare the displayed DNS name and algorithm with your provider. When rotating keys, also review older active selectors. Never enter private keys in a public checking tool. The Email Domain Check queries only published public DNS data.