Find and check the DKIM keys behind a domain's mail.
Type a domain, and a selector if you know it. The checker looks up the key under that selector, or tries the selectors mail services commonly use, and reads every key it finds the way receiving servers do.
DKIM for stripe.com
5 DKIM keys
36 common selectors tried
googleRSA, 1024 bits
TXT google._domainkey.stripe.com
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4T1PE2vh5xqRGzOrDnkoi03N/BFQ+GLa/xF69d8K0QOZBxTJbttc2DxcPdpvxqQRQOheompWvzCvWw/SH/NMgq72ulPKz2nHQbU6wIucXMf/sizgnsy+Ihiw9S5c/5sBMHUVZStqhHMuY8BGx0wGLavSmMFzBNdchT4g+46OuhQIDAQAB
A 1024-bit key is the minimum; RFC 8301 recommends 2048 bits.
- v=DKIM1
- Marks the record as a DKIM key.
- k=rsa
- The key type: rsa.
s1RSA, 1024 bits
TXT s1._domainkey.stripe.com
k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDRJjDdiZeTAd6hRY1BMQH098lqTGwdTCGuY4VKbDxV29kTyKZ9e2J/5+AfMHRlraj+i7QCl663jZz619AdTE7u88HI+CwlEwTVkjuK8+uIhUR3V/PhtLhzSP7GBm4JDUbi1I3tiUJjYTxQAhSIyso6QoDrv6kS6uoud+UT6kCq/wIDAQAB
A 1024-bit key is the minimum; RFC 8301 recommends 2048 bits.
- k=rsa
- The key type: rsa.
- t=s
- Strict: the signing domain must match exactly, no subdomain.
s2RSA, 1024 bits
TXT s2._domainkey.stripe.com
k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDR/9Km49dOTJZfnn/mL4N3Pv6RDxVq7VmN+/fYUcy3LUv2Vczz7TQFe071srBQWAOCpEQLAXJbRJYp+ltcW8IGECRGYLabp6un7lWDO4TVTXNwe+YKgCwSnNv8fREDXa44KU2zYp3rkaAmm2EaXrZLCupKQ8hR3ZcIJqzmdl1iUwIDAQAB
A 1024-bit key is the minimum; RFC 8301 recommends 2048 bits.
- k=rsa
- The key type: rsa.
- t=s
- Strict: the signing domain must match exactly, no subdomain.
mandrillRSA, 1024 bits
TXT mandrill._domainkey.stripe.com
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrLHiExVd55zd/IQ/J/mRwSRMAocV/hMB3jXwaHH36d9NaVynQFYV8NaWi69c1veUtRzGt7yAioXqLj7Z4TeEUoOLgrKsn8YnckGs9i3B3tVFB+Ch/4mPhXWiNfNdynHWBcPcbJ8kjEQ2U8y78dHZj1YeRXXVvWob2OaKynO8/lQIDAQAB
A 1024-bit key is the minimum; RFC 8301 recommends 2048 bits.
- v=DKIM1
- Marks the record as a DKIM key.
- k=rsa
- The key type: rsa.
cmRSA, 1024 bits
TXT cm._domainkey.stripe.com
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDsHNFnC9xrivujfoSFF3IIn3pBDKMn/sEAiHhr1R+kZhwCScPf8dTwQ0BXvNfeIqcb9vRkqualMWOSKmOPnFWuI/cx5fCEs7WBMoS6zBMlD5YEpHOThnndqWgjKhv4IqT5ezEgYT6SOS5iZmMOkZahnC68mTtIIIG17ap+F6lbPQIDAQAB
A 1024-bit key is the minimum; RFC 8301 recommends 2048 bits.
- v=DKIM1
- Marks the record as a DKIM key.
- k=rsa
- The key type: rsa.
DKIM is one half of what DMARC checks; the other is SPF. See the DMARC checker and the SPF checker.
Behind every check
- 24.6 million
- IP addresses profiled
- 2.7 million
- malicious domains tracked
- 228,000
- disposable email domains
- 2.3 million
- networks scored
Counts read live from the engine, not written into the page. The full dataset is published on GitHub under the MIT license and rebuilt every 30 minutes.
What a DKIM record does
DKIM (DomainKeys Identified Mail) lets a sending server sign each message with a private key. The matching public key sits in DNS under a selector, at selector._domainkey.example.com, and receiving servers fetch it to check the signature. A valid signature proves the message came from a server holding the domain's key and was not changed on the way.
Selector
The name a key is published under. Each mail service gets its own, which is why one domain often has several keys.
p
The public key itself, in base64. An empty p= revokes the key.
k
The key type: rsa, or the shorter ed25519.
t
Flags: y puts the key in testing mode, s requires the exact domain.
Key length
An RSA key needs 1024 bits at least, and 2048 is the recommendation (RFC 8301).
How to find a domain's selector
Open an email the domain sent and show its original source. The DKIM-Signature header holds s=, the selector, and d=, the signing domain. Without a message at hand, the checker tries the selectors that Google Workspace, Microsoft 365, Mailchimp, SendGrid, Fastmail, Proton Mail and other services give their customers.
DKIM and forged mail
A signature that verifies for the From domain is one of the two ways a message passes DMARC; the other is SPF. A DKIM signature usually survives forwarding, which breaks SPF, so a domain that signs all its mail keeps passing DMARC when its mail is forwarded. Without DKIM, a domain at DMARC reject can lose forwarded mail.
Questions people ask.
A tool that looks up a domain's DKIM public keys and checks them: whether the record is valid, the key type and length, and whether the key is revoked or in testing mode. Type a domain above to check one.
The domain may sign under a selector of its own. Open a mail it sent, find s= in the DKIM-Signature header, and enter that selector. A domain that does not sign at all has no key to find, and its mail can then pass DMARC only through SPF.
It is the minimum receivers accept. RFC 8301 recommends 2048 bits, and Google Workspace and Microsoft 365 both let you create 2048-bit keys; publish the new key under a new selector and switch once it is in DNS.
Yes, one per selector. A domain that sends through Google Workspace, a newsletter service and a help desk usually has a key for each, and rotating a key means publishing the new selector before retiring the old one.
An empty p= tag revokes the key, and any signature made with it fails. Services publish an empty key when they retire a selector, so a revoked key on an old selector is normal; one on the selector your mail still uses breaks DKIM.
No. DKIM signs a message so receivers can check where it came from and that it was not changed; anyone along the way can still read it. Encryption in transit is TLS, a different layer.
Other free tools.
DMARC checker
Check a domain's DMARC policy, where its reports go, and the mistakes that stop it working.
OpenSPF checker
Check a domain's SPF record, the DNS lookups it needs against the limit of 10, and the mistakes that make it fail.
OpenMX lookup
See a domain's MX records, the mail service behind them, and whether FFraud lists the domain as disposable.
OpenDo it in code.
The same answer from a free API endpoint, with the reason, the recency and the network around the address. Or download the confirmed blocklist for bulk blocking. No card, no quota, no expiry.