LeaderboardEvery site, rankedFree toolsChecks, no sign-upAgentsYour agent fixes itDocsThe API and MCP

DKIM checker

Find a domain’s DKIM keys at the selectors mail services use, or at your own, with each key’s type and its length in bits.

More checksPagesUtilities

The answer for allbirds.com

allbirds.com7 DKIM keys found, 2 need a look
  • google._domainkeyRSA2,048 bitsGood
  • selector1._domainkeyRSA2,048 bitsGood
  • selector2._domainkeyRSA2,048 bitsGood
  • k1._domainkeyRSA1,024 bitsWarning
  • s1._domainkeyRSA2,048 bitsGood
  • s2._domainkeyRSA2,048 bitsGood
  • mandrill._domainkeyRSA1,024 bitsWarning
  • Warningk1: 1024-bit RSA: works, but 2048 is the size to use
  • Warningmandrill: 1024-bit RSA: works, but 2048 is the size to use
  • NoteOnly the common selectors were triedA key at a selector not on the list may exist; type it beside the domain to check it.

Selectors tried: google, selector1, selector2, k1, k2, default, s1, s2, dkim, mail, smtp, mandrill, mxvault, zoho, protonmail, fm1, fm2, fm3, everlytickey1, cm. A key’s length is read from its own bytes. Asked of public resolvers (1.1.1.1 and 8.8.8.8) as anyone on the internet sees it, at the moment of the check. A record changed in the last few hours may not show everywhere yet.

One part of allbirds.com’s DNS.The DNS health check reads its name servers, SOA, addresses, CAA and every mail record at once.
Check all of its DNS

What does it check?

No rule in the rulebook covers this, so here is what it reads.

  1. The selectors common senders use, or the one you give
  2. Each public key found, its type and length
  3. Whether a key is revoked

Questions

What is a DKIM selector?

The name a key is kept under, at selector._domainkey.yourdomain. Each sending service has its own.

How long should a DKIM key be?

2048 bits. 1024 still works but is weak.

How do I find my selector?

Open a message your domain sent and read its DKIM-Signature header: the s= value is the selector.

A key, and where it is keptExample
The address
s1
Selector, named by the sender
._domainkey.
Always this
example.com
The domain
The TXT record there
v=DKIM1
Version
k=rsa
Key type
p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu3x…IDAQAB
The public key, 2048 bits
In a message’s headers
d=example.com
The domain that signed
s=s1
The selector to look up

Each sending service signs with a selector of its own. A 2048 bit RSA key is the length to use; 1024 still works and is weak.

The whole site

One page is one part. A read checks every page against the whole rulebook and says what to fix first.

See allbirds.com’s report