Bulk DKIM checker: is the DKIM key published on every domain?
In short: Paste domains, enter the DKIM selector your sending tool gave you (or try 22 common ones), and see for each domain whether a key is published, its length, testing or revoked flags, and broken records. Limit: Without your selector it tries 22 common ones, so No key found doesn't prove a domain has no DKIM.
A bulk DKIM checker looks up the DKIM public key on many domains at once. Paste up to 100 domains, or 500 after a free Google sign-in, and enter the selector your sending tool uses, such as google or selector1, or leave it blank to try 22 common selectors. Each row shows the key found, its length, testing or revoked flags and record errors. CSV out.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
Blank: 22 common selectors are tried on every domain. Google Workspace uses google; Microsoft 365 uses selector1 and selector2.
Sample result
acme.example publishes a 2048-bit DKIM key at google._domainkey; globex.example has none there.
- Domain
- acme.example
- Selector
- Key
- 2048-bit RSA
What this means for you
Each sending domain needs its own key at the selector your tool signs with.
- Up to three selectors per run
- Key length, testing and revoked flags
- CNAMEs that point to no key
- 100 a run, 500 signed in; CSV
- DKIM
- Selector
- 2048-bit
By SimpleVerifier Team · Last updated
Also in: Português (Brasil) · Español · Deutsch · Français · Türkçe · 简体中文 · Русский · Nederlands · Italiano · Tiếng Việt · Bahasa Indonesia · Polski · العربية · Українська · Čeština · Magyar · 日本語 · 한국어
Got DKIM on every sending domain? Clean the list next.
- DKIM proves your mail is yours. It doesn't stop bounces, which hurt the same domains' reputation. Upload the recipient list at /verify to remove addresses that would bounce.
- The first 100 email checks are free with a Google sign-in, no card. For SPF, DMARC and MX on the same domains, use the bulk email authentication checker.
How do I check DKIM on many domains at once?
- Paste domains, one per line, up to 100 a run, or 500 after a free Google sign-in. Email addresses and URLs work too; the domain is taken from each.
- Enter up to three selectors, separated by commas, such as
googlefor Google Workspace orselector1, selector2for Microsoft 365. Leave it blank to try 22 common selectors on each domain. - Press Check DKIM. For each domain and selector the tool reads the TXT and CNAME at
<selector>._domainkey.<domain>, ten domains a request. DNS only. - Read each row: Key found, Weak key, Testing, Revoked, Broken, CNAME to nothing, or No key found, and download the CSV with every selector, key length and record.
Example
- You enter
- Two domains with the selector
google:acme.exampleandglobex.example. - You get
- acme.example: Key found, 2048-bit RSA at
google._domainkey.acme.example. globex.example: No key found forgoogle. With the selector left blank, 22 common selectors are tried on each domain. - Limits
- Up to 100 a run without an account and 500 when signed in with Google, counted over a minute. 10 domains a request, up to three selectors; DNS only.
How does a bulk DKIM check work?
DKIM (RFC 6376) signs each message with a private key, and receivers find the public key in DNS at <selector>._domainkey.<domain>. The selector is chosen by whoever signs the mail, so there's no way to list every key a domain has; a checker has to know or guess the selector.
Enter the selector your sending tool shows, and the tool reads exactly that record on every domain, which is the fastest and most reliable check. Leave it blank and it tries 22 common selectors used by Google Workspace, Microsoft 365 and large sending platforms, such as google, selector1, selector2, k1, s1 and default. Both read the TXT record and any CNAME, since many platforms delegate the key to their own DNS.
What do the results mean?
Key found: a valid DKIM record with an RSA key of 2048 bits or more, or an Ed25519 key. Weak key: an RSA key shorter than 2048 bits, usually 1024, still accepted but below the current recommendation, so rotate it. A key under 1024 bits shows as Broken, since RFC 8301 says receivers reject it. Testing: the record has t=y, which asks receivers not to treat failures differently from unsigned mail.
Revoked: the key is published empty (p=), which means it was withdrawn on purpose. Broken: the record can't be read as a DKIM key. CNAME to nothing: the selector is delegated to a platform, but the target has no key, usually because the setup was never finished there. No key found: none of the selectors tried has a key, which doesn't prove the domain has no DKIM, only that it uses another selector.
Which selector does my sending tool use?
Google Workspace defaults to google, and Microsoft 365 uses selector1 and selector2. Most platforms show theirs on the DNS setup page, and you can read it from any email you sent: the s= tag in the DKIM-Signature header is the selector, and d= is the signing domain.
To find every selector a single domain has published, with about 80 tried, use the DKIM selector finder. For one key explained tag by tag, use the DKIM checker.
Why check DKIM across many domains?
Cold email teams send from dozens of secondary domains, and each needs its own DKIM key in place before warm-up. Google's email sender guidelines require DKIM for bulk senders, and a domain that missed the step signs nothing. A bulk check with the selector you set up shows the gaps in one run.
It's also the quickest way to confirm a key rotation reached every domain, or that 1024-bit keys are gone.
Which DKIM tool should I use?
| Bulk DKIM checker | DKIM selector finder | Bulk email authentication checker | |
|---|---|---|---|
| Domains per run | 100, or 500 signed in | One | 100, or 500 signed in |
| Your own selector | Up to three | One, or about 80 tried | No, common ones only |
| Key length and flags | Per row | Per key | In the reason |
| SPF, DMARC and MX | No | No | Yes |
Who uses this tool, and for what?
- Cold emailers
- Confirm the DKIM key is published on every secondary sending domain before warm-up, with the selector your inbox provider uses.
- Agencies
- Check DKIM on all client domains in one run after onboarding them to a new sending platform.
- Email admins
- Confirm a key rotation reached every domain, and that no 1024-bit keys are left.
- Deliverability consultants
- Find domains where DKIM was delegated to a platform by CNAME but never finished.
What can’t this tool tell you?
- Without your selector it tries 22 common ones, so No key found doesn't prove a domain has no DKIM.
- It checks that the key is published, not that your mail is signed with it; a header from a sent message shows that.
- Up to three selectors per run.
- DNS only. Nothing is sent to the domains.
- Up to 100 domains a run without an account, 500 signed in.
Common questions
- How do I check DKIM for many domains?
- Paste the domains into a bulk DKIM checker like this one and enter your selector, or leave it blank to try 22 common ones. Each row shows the key found, its length and any problem, with a CSV download.
- Is this bulk DKIM checker free?
- Yes. Up to 100 domains a run without an account, and up to 500 a run when you sign in with Google, with no card.
- What is a DKIM selector?
- The name under _domainkey where a public key is published, chosen by whoever signs the mail. It appears as s= in the DKIM-Signature header of every signed message.
- Why does a domain show No key found?
- None of the selectors tried has a key. The domain may use another selector, so enter the one your sending tool shows, or run the DKIM selector finder on that domain.
- Is a 1024-bit DKIM key a problem?
- It still works, but 2048-bit keys are the current recommendation. The row marks RSA keys shorter than 2048 bits as weak, and keys under 1024 bits as broken.
- Does it send any email?
- No. It only reads DNS records. Nothing is sent to the domains or their mail servers.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.