What is a DKIM record?

DKIM (DomainKeys Identified Mail) lets a mail server sign each message with a private key. The matching public key is published as a TXT record at ._domainkey. , so receivers can check that the message came from an authorized server and was not changed on the way.

What is a DKIM selector?

A selector is the name that tells receivers which key to fetch, so one domain can have several keys: one per mail provider, or an old and a new key during rotation. You find it in the s= tag of the DKIM-Signature header of a message you sent. Google Workspace uses google, and Microsoft 365 uses selector1 and selector2.

Why does the checker find no DKIM key?

DNS cannot list every selector of a domain, so we look up the ones common providers use. If your provider picks its own, such as Amazon SES or Mailgun, enter the full name, for example s1._domainkey.example.com, to check that selector.

How long should a DKIM key be?

Use a 2048-bit RSA key. 1024-bit keys still work but are no longer recommended, and receivers ignore keys shorter than 1024 bits. Some DNS hosts need a 2048-bit key split into several strings in one TXT record, which receivers join back together.

What does t=y mean in a DKIM record?

t=y marks the key as being in testing mode. Receivers may treat failed signatures as if the message was unsigned, so remove the flag once signing works.

Yes. The /api/v1/email-auth endpoint returns the DKIM keys with their type and length, together with the SPF and DMARC results. Pass selector._domainkey.example.com to check one selector. See the API documentation for authentication and plan limits.

Check the DKIM keys of any domain

Results for

github.com

Full analysis

Email authentication

2 warnings

Warning

SPF: Warning:~all (soft fail), 10 of 10 lookups
DMARC: Pass:p=quarantine
DKIM: Warning:7 keys: google, selector1, k1, k2, k3, s1, s2
MTA-STS: Note:Not set up
TLS reporting: Note:Not set up
BIMI: Note:Not set up
Mail servers: github-com.mail.protection.outlook.com

DKIM keys

24 selectors checked

Warning

google._domainkey.github.comPass:2048-bit RSA
Show record
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj6T5sl/RwdSqGoYWaWaFbS2UAeyPrEmd0gogocmRfS441qwR8/0KB81Hw89P0l4YiFRrXYk7NVIGfyCRHAYYZUzCkGeOysI2EjgzLFhd/NEsbRzOEc/kWkK/RO6JFq/5lOn6M9AZw/ap9tds4JG9ApgNNdSpPxp9DmvpsOSgNMVflRxQFrk3kdS4RNAPKu/OPoA7dlR/A/pECryjRoYgENtDXzdnK70HgCekems6UDzxDj61cjyoKoXtEMF/QsaHEQ1Gjfv014rDJBsubk/kT5VqHkWHa/ia68Z5r228Ety/wFfQNjXTx/J7KGZ9GkZlKED659eiJcLnWcKDSiQlhwIDAQAB
selector1._domainkey.github.comWarning:1024-bit RSA
- 1024-bit RSA key. 2048 bits is the current recommendation.
Show record
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxZC/z2cK+2s1f/ktzSDSeFzkfIHrjwtGFsfKMAYvKaXjPVNzKykpbXBkX5nB7dVUTFttda7aROr2iSrIseQ27Ui+4rUZVzgFanE8RaXhYM9n5wPKNv8GtLJk7JgcsYZ7ErgID4uW2sEYyV/dnRYw6rDzOaeRKkKELTUfJI5ebLQIDAQAB;
k1._domainkey.github.comWarning:1024-bit RSA
- 1024-bit RSA key. 2048 bits is the current recommendation.
Show record
k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i89sA2guU0ta4UX1Xzm06XIU6iBP41VwmPwBGRNofhBVR+e6WHUoNyIR4Bn84LVcfZE20rmDeXQblIupNWBqLXM1Q+VieI/eZu/7k9/vOkLSaQQdml4Cv8lb3PcnluMVIhQIDAQAB;
k2._domainkey.github.comPass:2048-bit RSA
Show record
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2aC2KjGKLOwTweBY5A9RpjsxaBXR9r7OAU6U8/zn92ivImI75naUujWbItRI/QmL1jy5PWGqLwoUA0b90ObWaLDc+i9MtTNmGeWO009hr20fIxhGg6XBT2kjZ1DTThopSe1nAndsupmcBwlQ5Q6LJ+ZAxLcujnPIxM0ZBLmgpkv8u6RfY4eFP8OLvdAW3oSuB0DyLDigQX4Sj8wBO4YIdQH6AAmBeOsidsKAFNFUCpc3vCxtBDR12U+cBg724l3sBkMQ8evnz6idnqxq9QAVYh8k4kJ+RP+6cqTdy7LjIm8xY/bQNpQIpGUAuDo2DjLcCDun9DAI4Q/3z+Q0o9QuQIDAQAB;
k3._domainkey.github.comPass:2048-bit RSA
Show record
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsYGiMSn7fsUqSvfSX40x9R1OlRtbNiCY80lHRIlcKx3XDIR7257aUx+q9CSIARdfTL6KCuLGNFx5g9TgVr6png4ajcieSQGtOehBgxnkDN8aAA5TX0FmFrcefJU0JoxLOF09EKgXxhSSHCk/ekVb0PXSboHXoZ9+EI404F1qhcwXXIgHXTaUthHTut2P6BBZhIXIgvDe/w49GchR7MRJqjNb7neEBbYHbgWuBTvvHCg7Gy6m6n9krYK+ROWq3dVvXy9plAGK3ygM+HtjIiMt7arRGMOF0WgDTz7YdN9BGpt6BvXxLnjiQcgS5T9n+cIyPZgiWzDMXNlaEEdKTEKxrwIDAQAB;
s1._domainkey.github.comPass:2048-bit RSA
Show record
k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyn3fMCVpb7ryIRKOGXhXVGYmsWUitNlSckqGHOwNFZgFadplOrD+Qzf1XQkP7MH/VB/97DsAAJGtEXW1Uq71Hjnfr/DuBN/YfjF/gU70qEFb7q1sdIiNtjFL2TkOpoW+X/bhhPNheW/fYwyFb6ZHFM6LTgXyuimWRHTOUP3VjZzhNVda79nt+2WZYbS4l8HdMgWpTNHjpVw5PtXESA9KBg/evSRk5fIaXIX5eRXW3baoV9yVzD8O29/IL/DiSk+yNvaO0EHL5c4yGuZJhGzvpiznb2IDVdemJK4Dqzdy5FTN/SGYZhAEr7MguG3Z314hMS2scgMsOMgB64uj/6+6UwIDAQAB
s2._domainkey.github.comPass:2048-bit RSA
Show record
k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNt2/H6bKs99C6DAaokPp62KN9mKaD20D1PBakkObejkJvzM6Un/fKHPeI2/qXdvFFBPQE3mxMNoe+hwBVDgMgCuZEn8J6gZYI4amITure9/ny6+GaNVRoH2m6xAtWwKINkKxMayGiehkWlRVb7D23F0U8y+VDHKQFz1bnXA5jDpcDiMXy8i2lV5vEys+qt+1WGhDKCAwamT8c3xkZz8aXMJaXYCiN2HMgHDU81+mVCk4+u6mY+a98APVfFhsQ0KCq/mVZXaXTV06QrG9M5PtBHUFW7VtwXKp+AFrAut0KW1NnwaA5IGA5sc+n9dma7bSqdfGS+ixdSmJ69NwmYSHwIDAQAB

Selectors we checked (24)

google
selector1
selector2
default
dkim
mail
k1
k2
k3
s1
s2
smtp
mx
mandrill
mxvault
protonmail
protonmail2
fm1
fm2
sig1
zmail
kl
s1024
s2048

To check another selector, enter it as selector._domainkey.github.com.

SPF record

10 of 10 DNS lookups

Warning

v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all

Uses 10 of 10 DNS lookups. One more include can break SPF.
Ends in ~all (soft fail), so receivers accept mail from unlisted servers but mark it as suspicious.

Includes

9 domains

include:spf.protection.outlook.com1 lookup
include:_netblocks.google.com1 lookup
include:_netblocks2.google.com1 lookup
include:mail.zendesk.com1 lookup
include:_spf.salesforce.com2 lookups
include:servers.mcsv.net1 lookup
include:mktomail.com1 lookup
include:sendgrid.net2 lookups
include:ab.sendgrid.net1 lookup

DMARC record

_dmarc.github.com

Pass

v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1

Policy p=quarantine: receivers send mail that fails DMARC to spam.
Aggregate reports go to dmarc@github.com.

Policy: quarantine (send to spam)
Subdomain policy: reject (refuse)
Percentage: 100%
Aggregate reports: dmarc@github.com
Failure reports: dmarc@github.com
DKIM alignment: Relaxed
SPF alignment: Relaxed

MTA-STS, TLS reporting and BIMI

Optional records

MTA-STS

Not set up

No MTA-STS record. Sending servers may deliver mail to this domain without TLS when an attacker strips it.

TLS reporting

Not set up

No TLS-RPT record, so nobody hears about failed TLS connections to your mail servers.

BIMI

Not set up

No BIMI record, so inboxes that support it show no brand logo next to your mail.

Run this lookup from code

The API returns this result as JSON. The free plan includes 100 API calls per month.

curl "https://hostingchecker.online/api/v1/email-auth?query=github.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

Get a free API key Read the API docs

View full analysis

How it works

How DKIM works

The sending server hashes the message body and selected headers, signs the hash with its private key and adds a DKIM-Signature header. The header names the signing domain (d=) and the selector (s=). The receiver fetches the public key from DNS and verifies the signature.

A valid signature proves the message was not changed and was signed by someone with access to the domain's DNS. For DMARC to pass on DKIM, the signing domain must match the domain in the visible From address.

v: Version, always DKIM1
k: Key type: rsa (default) or ed25519
p: The public key. Empty means the key is revoked
t: Flags: y for testing, s for no subdomains

FAQ

DKIM checker FAQ

Common questions about DKIM keys and selectors.

Related guides

Learn more from the blog

Step-by-step guides on reading and using these results.

Related tools

More free tools

Explore our other free lookup and analysis tools.

Free lookup tool