Skip to content
Free deliverability tool

Free DKIM Record Validator & Key Checker

DKIM signs your messages so a receiver can prove they were not altered and came from someone holding your private key. The public key lives in DNS at a selector you choose. Most providers now hand you a CNAME so they can rotate keys without asking you to touch DNS again.

Leave it empty and we probe the selectors the major providers use.

Predefined real examples:Click to test live

No signup · we do not record what you check

Worked example — sada._domainkey.example.com

Sample demonstration
  • PassSelector resolvesCNAME → sada.dkim.sadasend.net
  • PassKey typersa
  • PassKey length2048 bits

    Comfortably above the 1024-bit floor.

  • PassProxy statusDNS only

    Proxying a DKIM record breaks the lookup entirely.

Valid 2048-bit key, resolving cleanly through a CNAME.

SadaSend runs these checks continuously on your sending domains, and refuses to send until they pass — so mail Gmail would reject never leaves.

Start free

Predefined Real-World Test Scenarios

Live verification vectors
Google Workspace2048-bit RSA
google.com · selector: 20230601

Inspects Google’s active 2048-bit RSA public key record published in DNS.

GitHubEnterprise DKIM
github.com · selector: pf2014

Validates cryptographic signature key published in DNS for outbound mail.

SadaSendCNAME Rotation
sadasend.com · selector: sada

Validates CNAME delegation to sada.dkim.sadasend.net for automated key rotation.

What this checks

  • The selector resolves and returns a key
  • The record parses and the key type is supported
  • Key length meets the 1024-bit minimum, 2048 preferred
  • The record is not proxied — Cloudflare's orange cloud breaks DKIM
Production Email Infrastructure

Ready for rock-solid transactional email?

Automated 2048-bit DKIM key rotation, domain-level SPF alignment, and suppression firewalls. Send 6,000 free emails every month with zero credit card required.

Questions

Other tools