Skip to content

DKIM checker

DKIM signs outbound mail so receivers can prove a party that controls your domain sent the message. Selector names are not listed in a directory, so this checker probes common provider names and reports which keys are live, revoked, test-only, or weak. A key that cannot be discovered cannot be scored.

Public results are listed under "Last assessed domains". What we store

Public assessments are free. No account. The full 0 to 100 stack is included below the focused result.

Assessments are free and always will be. SecLens.ONE is funded by its operator, 42Sec PTE. LTD. There is no paid tier, no API product and no monitoring service today. A private assessment (see the checkbox in the scan dialog) is the only difference.

57.1%
of mail-enabled Top-1M domains have a discoverable DKIM key
53.9%
of domains with a live key still keep a 1024-bit or weaker RSA key

Figures from the October 2026 Top-1M study.

The same assessment, protocol by protocol

Every checker below runs the full SecLens.ONE assessment and leads with its own result. The scoring weights are on the methodology page.

DMARC checker

DMARC tells receiving mail servers what to do with messages that fail SPF or DKIM for your domain.
SPF checker

SPF lists which hosts may send mail as your domain.
MTA-STS checker

MTA-STS tells sending servers to use TLS to your MX hosts and to refuse a downgrade.
DANE checker

DANE binds MX certificates to DNS with TLSA records, but only if DNSSEC is actually validating.
TLS-RPT checker

TLS-RPT is how sending servers tell you that STARTTLS failed on the way to your MX.
Email security score

SecLens.ONE scores a domain from 0 to 100 across seven email-security protocols, using the same live DNS checks as the rest of the product.
Email spoofing check

If a domain publishes no DMARC policy, or publishes p=none, anyone can send mail that looks like it came from that domain.

Common questions

How does a DKIM checker find selectors?

DKIM selectors are not published as a list. SecLens.ONE probes well-known names used by Google, Microsoft, and other providers (s1, selector1, google, and similar). If your provider uses a random selector, add a CNAME from a well-known name to that key host so discovery can see it.

Does a found key mean DKIM is protecting me?

Only if the key is a production key: valid syntax, not revoked, not t=y test mode. A 1024-bit RSA key still signs mail but is below the current floor. This checker reports selector status first, then the rest of the stack.

Why do you probe so many selector names?

RFC 6376 does not define default selectors. Providers pick their own. Probing a catalog is how a public checker finds keys without reading your outbound mail. A miss often means a custom selector, not a missing DKIM setup.

Scoring rules are on the methodology page. The homepage still has the full product, including the live Pulse.