DKIM Record Checker

What Is DKIM and Why Do Selectors Matter?

DomainKeys Identified Mail (DKIM) is an asymmetric cryptographic authentication standard (RFC 6376). When an outgoing email is dispatched, the sending mail server signs the message body and key headers with a private encryption key, attaching a DKIM-Signature header.

Receiving mail servers look up the sender's public key in DNS at selector._domainkey.domain.com to verify the digital signature, ensuring the message was genuinely authorised and not modified in transit.

Common Provider Selectors

Different email services use distinct selector prefixes to allow multiple sending platforms to sign on behalf of one domain:

• Google Workspace: google
• Microsoft 365: selector1 or selector2
• Mailchimp / Mandrill: k1, k2, or mandrill
• SendGrid: s1, s2, or smtpapi
• Amazon SES: default or randomised 16-character alphanumeric strings

1024-bit vs 2048-bit Key Lengths

Modern security standards require 2048-bit RSA keys for DKIM signatures. Legacy 1024-bit keys are susceptible to factoring attacks and are increasingly flagged as insecure by receiving enterprise mail gateways.