Where do I get the DKIM selector?

From the header of a sent email: the s= field in the DKIM-Signature line. Common values are default, s1, google, k1, dkim or a date. If you leave the field here empty, the tool tries the usual selectors itself.

DKIM record is not found, what does that mean?

Either DKIM is not set up for the domain, or the selector actually in use is not on the list that is tried. Certainty only comes from looking at the DKIM-Signature header of a real message: enter the selector named there in the field above and check again.

What key length should DKIM have?

At least 1024 bit (RFC 8301), 2048 bit recommended. Shorter keys are considered insecure and are rejected by some providers. Ed25519 (RFC 8463) is a short, modern alternative but is not supported everywhere yet, which is why RSA is kept in parallel.

What does an empty p= value mean?

The key has been revoked. Signatures with this selector then fail. The entry should only be removed once no old mail with this selector is still in transit.

What does t=y in a DKIM record mean?

Test mode: receivers treat mail as if it were not signed and do not enforce the signature. Meant for the introduction phase. In regular operation the flag belongs removed.

Should I rotate DKIM keys?

Yes, every few months. In practice this works with two selectors in alternation: publish the new key, switch sending to it, delete the old record after a transition period. Many providers do this automatically when the record is a CNAME to them.

DKIM Lookup

Query the DKIM public key, check the real key length and the record status.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature over selected headers and the message body to outgoing email. The matching public key sits as a TXT record in DNS at <selector>._domainkey.<domain>. A receiver reads the selector from the message's DKIM-Signature header (field s=), fetches the key and checks whether the signature holds. DKIM is the second pillar under DMARC and, unlike SPF, survives forwarding and mailing lists.

What this tool checks

With a known selector it queries exactly that record; if the field is left empty it tries a curated list of common selectors in parallel and shows each hit as its own branch. The key is not estimated but decoded and measured exactly: RSA bit length, Ed25519, public exponent. It also checks the tag syntax per RFC 6376 section 3.6.1 (v, k, h, p, s, t, g, n), an empty p= (revoked key), test mode t=y, the obsolete g tag and the TTL of the record.

Reading the result

Green stands for a record that was found, with valid syntax and a key of at least 1024 bit, 2048 bit being common. Warnings appear for keys below 1024 bit, for t=y (receivers then do not enforce the signature), for obsolete or unknown tags and for h=sha1. An empty p= is reported as a revoked key. If nothing is found with an empty selector field, that does not necessarily mean DKIM is missing: the selector in use may simply not be on the list that is tried.

Background

The reference is RFC 6376. The format of the key record is in section 3.6.1, the layout of the DKIM-Signature header in section 3.5, canonicalisation (relaxed/simple) in section 3.4. RFC 8301 raises the minimum key length to 1024 bit and forbids SHA-1, RFC 8463 introduces Ed25519 keys.

Common problems and how to fix them

DKIM record missing. First enable signing at the mail server or sending service, which assigns a selector. Set the TXT record named by the service into DNS exactly as given (often as a CNAME to the provider so the key can be rotated there), then check a test mail to yourself.
Signature fails although the record is there. Usually the published key no longer matches the sender's private key (rotation only on one side) or a DNS provider wrapped and thereby altered the long p= value. Set the record again from the provider's template.
Key too short. 512 or 768 bit keys are rejected. Have the service create a 2048 bit key and publish the new record, remove the old selector only after the switch.
Stuck in test mode. t=y is only meant for the introduction phase. Once the signature holds reliably, remove the flag, otherwise some receivers ignore the signature for the DMARC assessment.
Several selectors, one revoked. An empty p= should only be deleted once no mail with that selector is still in transit (typically a few days after rotation).

Common questions

Where do I get the DKIM selector?: From the header of a sent email: the s= field in the DKIM-Signature line. Common values are default, s1, google, k1, dkim or a date. If you leave the field here empty, the tool tries the usual selectors itself.
DKIM record is not found, what does that mean?: Either DKIM is not set up for the domain, or the selector actually in use is not on the list that is tried. Certainty only comes from looking at the DKIM-Signature header of a real message: enter the selector named there in the field above and check again.
What key length should DKIM have?: At least 1024 bit (RFC 8301), 2048 bit recommended. Shorter keys are considered insecure and are rejected by some providers. Ed25519 (RFC 8463) is a short, modern alternative but is not supported everywhere yet, which is why RSA is kept in parallel.
What does an empty p= value mean?: The key has been revoked. Signatures with this selector then fail. The entry should only be removed once no old mail with this selector is still in transit.
What does t=y in a DKIM record mean?: Test mode: receivers treat mail as if it were not signed and do not enforce the signature. Meant for the introduction phase. In regular operation the flag belongs removed.
Should I rotate DKIM keys?: Yes, every few months. In practice this works with two selectors in alternation: publish the new key, switch sending to it, delete the old record after a transition period. Many providers do this automatically when the record is a CNAME to them.