Leave the selector blank to probe common ones. Read live from public DNS.
What DKIM does
- What it is
DKIM signs every message with a private key that only you hold.
- Why it matters
Receivers verify the signature against the public key in your DNS. Intact signature, verified sender.
- Without it
Without DKIM, a message can be altered in transit — or forged entirely — with nothing to prove otherwise.
What we check
- Whether a DKIM key exists at
selector._domainkey.yourdomain - The key type (RSA or Ed25519) and whether a public key is present
- Revoked selectors (an empty
p=value)
Common questions
Why do I need a selector?
DNS gives no way to list a domain's DKIM selectors, so a key can only be found if you know its selector. We probe the common ones providers use, but a custom selector must be entered directly.
Where do I find my selector?
It's in the s= tag of the DKIM-Signature header on a message you've sent, or in your email provider's DNS setup instructions.