DKIM
This checker scans your domain’s DNS for DKIM keys at 22 common selector prefixes and passes when it finds a 2048-bit key, meaning mail signed with it can be verified by receivers as unaltered and genuinely from you.
Questions
DKIM keys live at selector._domainkey.yourdomain.com, and the selector name is chosen by your email provider: Google Workspace uses “google”, Microsoft uses selector1/selector2, many ESPs use k1 or s1. There is no way to list a domain's selectors from outside, so this checker scans 22 common ones, including the date-style selectors a few providers publish. A clean scan is strong evidence of missing DKIM, not absolute proof.
2048-bit RSA. 1024-bit keys still pass validation but are legacy strength, and providers have had shorter keys cracked and spoofed. If this scan flags a 1024-bit key, rotate it. Your provider's dashboard almost always offers 2048 now.
Yes. SPF breaks on forwarding; DKIM survives it. DMARC needs only one of the two to pass IN ALIGNMENT with your From domain, so running both is what keeps legitimate mail deliverable when one mechanism fails.
A pass means this scan found a DKIM key at one of the 22 selectors it checks and the key is 2048-bit, which meets current strength recommendations.
A failure means the scan found no key at any of the 22 selectors it checks, or found one that is only 1024-bit, which is legacy strength; because selectors cannot be listed from outside, a clean scan is strong evidence of missing DKIM rather than absolute proof.
Turn on DKIM signing in your email provider's dashboard, publish the key it gives you as a TXT record at selector._domainkey.yourdomain.com, and rotate any 1024-bit key to 2048-bit if your provider offers it.
Free
Paste it, and the rule-set from 4,000,000 sends scores it. The report lands in your inbox in minutes, and a full three-step sequence written for your ICP follows from Hugo a few hours later.
EMPRA