What is a DKIM selector?

A name that tells receivers where to find the public key: the key for selector s1 lives at s1._domainkey.example.com. A domain can have several, one per sending service. The selector is printed as s= in the DKIM-Signature header of every signed message.

What DKIM key size should I use?

2048-bit RSA. 1024-bit keys still verify but are the minimum RFC 8301 allows, and keys shorter than 1024 bits must be treated as invalid. Ed25519 keys are short by design and are not a problem.

What does t=y mean in a DKIM record?

Testing mode: the domain is telling receivers not to treat a DKIM result differently from unsigned mail. Remove it once signing works.

Free tool

DKIM record checker

Look up a domain's DKIM public key by selector, or try the common provider selectors, and check the key's type, size and testing flag.

Last updated 2026-10-21

Run it with curl

This tool is also a free API: no account, no key, CORS open. OpenAPI description.

curl "https://sendly.now/api/tools/dkim-checker?domain=example.com&selector=selector1"

# Markdown instead of JSON:
curl -H "Accept: text/markdown" "https://sendly.now/api/tools/dkim-checker?domain=example.com&selector=selector1"

Finding your selector

Open a message the domain sent, view its original or raw source, and find the DKIM-Signature header. The s= value is the selector and d= is the signing domain. Enter both here; a domain that sends through several services has a selector for each.

What a healthy key looks like

A 2048-bit RSA key, or an Ed25519 key.
No t=y testing flag once signing works.
One record at the selector name, published exactly as the provider gave it, with no line breaks inside p=.

Questions people ask

What is a DKIM selector?: A name that tells receivers where to find the public key: the key for selector s1 lives at s1._domainkey.example.com. A domain can have several, one per sending service. The selector is printed as s= in the DKIM-Signature header of every signed message.
What DKIM key size should I use?: 2048-bit RSA. 1024-bit keys still verify but are the minimum RFC 8301 allows, and keys shorter than 1024 bits must be treated as invalid. Ed25519 keys are short by design and are not a problem.
What does t=y mean in a DKIM record?: Testing mode: the domain is telling receivers not to treat a DKIM result differently from unsigned mail. Remove it once signing works.

Something on this page out of date, or missing the case you are in? Write to support@sendly.now — we answer our own email. The full technical detail lives in the documentation.