DKIM checker

Probe common DKIM selectors and inspect published keys. Add a selector if the audit does not know the one your sender uses.

What a DKIM selector tells you

DKIM signs selected headers and the body under a domain and selector. The public key lives at <selector>._domainkey.<domain>. The checker reports selectors it can read, selectors with no key, and revoked keys with an empty p=.

Why a selector can be missed

The sender uses a selector outside the common probe list.
The selector is rotated and the old DNS record is stale.
A gateway rewrites the message after signing.
The key is published but is 1024-bit or otherwise weak.

For a failed signature, read DKIM body hash did not verify. For provider selectors, use the Google Workspace and Microsoft 365 guide.