← All checks

DKIM selector not found: how to check your DKIM record

DKIM selectors medium Email authentication · 8 of 100 points

What it inspects

This scanner queries <selector>._domainkey.<domain> for 36 common selector names (default, selector1, selector2, google, k1, s1 and others), plus one selector you can enter on the form. DNS cannot list selectors, so a selector outside that list is invisible to us. Verdicts: PASS when at least one selector has an RSA key of 2048 bits or more, or an Ed25519 key. WARN when no selector is found among the common names, when all found RSA keys are under 2048 bits, when a key cannot be parsed, when only revoked keys (empty p=) are found, or when the strong keys are marked t=y (testing). It never FAILs. It is not applicable when SPF says the domain sends no mail (v=spf1 -all or v=spf1 ~all).

Why it matters

DKIM signs each message so receivers can prove it came from a server you authorised and was not altered. DMARC passes if either SPF or DKIM passes in alignment, and DKIM survives forwarding where SPF does not. Short 1024-bit RSA keys are weak enough to be worth rotating.

How to verify by hand

# bash
dig +short TXT selector1._domainkey.example.com

# PowerShell
Resolve-DnsName -Name selector1._domainkey.example.com -Type TXT | Select-Object -ExpandProperty Strings

Replace selector1 with your provider's selector. A key looks like v=DKIM1; k=rsa; p=MIIBIjANBg... The selector is the s= value in the DKIM-Signature header of a message you sent.

How to fix

Enable DKIM signing at your mail provider and publish the key it gives you. If you already did, rescan using your selector in the Advanced field.

  1. Find your selector: open a message you sent and look for s= in the DKIM-Signature header.

  2. Publish the key exactly as the provider gives it (2048-bit RSA or Ed25519):

    selector1._domainkey.example.com.  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...AQAB"

    Many providers ask for a CNAME instead; publish what they tell you.

  3. Remove t=y once you have confirmed signing works, and rotate any 1024-bit key to a new selector.

References

Scan your domain free