DKIM Key Strength Checker
Inspect your DKIM selector, key length, algorithm, hash function, and flags - and get a clear strength score with specific upgrade recommendations to prevent signing failures.How the DKIM Key Strength Checker Works
Enter your domain and DKIM selector and the tool performs a live DNS lookup, extracts your public key, and runs a full cryptographic analysis.
1
Enter domain and selector. Provide your root domain and the DKIM selector your mail server uses. Common selectors include
default, google, s1, and selector1 - or leave it blank to auto-detect.2
Security checks run. We analyze key length, algorithm type, hash function, the service flag, and the testing flag - then score your key from 0 to 100.
3
Get prioritized recommendations. See exactly which checks failed and why, with specific remediation steps ordered by risk to fix weak keys and deprecated algorithms.
What the Checker Analyzes
Every check covers a cryptographic or operational aspect of your DKIM signing key that can be read from public DNS.
Key length
RSA-1024 is deprecated and factorable with modern compute. The minimum recommended length is 2048-bit RSA; Ed25519 elliptic-curve keys are the modern best practice.
DKIM key rotation guide →
Hash algorithm
SHA-1 is cryptographically broken - practical collisions exist, and many receivers are beginning to reject SHA-1 signed mail. SHA-256 (
What is DKIM? →
h=sha256) is required.Flags & rotation
We flag a missing
How to rotate DKIM keys →
s=email service tag and the t=y testing flag. DNS cannot reveal key age, so rotation is shown as a reminder, not a score - rotate roughly every 6 months.Common DKIM Key Security Issues
These are the most critical problems the checker finds - and what each means for your email security posture.
Critical
RSA-1024 key in use
1024-bit RSA keys can be factored using cloud compute - NIST deprecated RSA-1024 in 2013, and Gmail has begun warning about (and rejecting) 1024-bit DKIM signatures.
Generate a new 2048-bit RSA key (or Ed25519) through your ESP or mail server, publish the new record, wait 48 hours, then retire the old key.
Generate a new DKIM record →
Critical
SHA-1 hash algorithm
SHA-1 is cryptographically broken - practical collision attacks are public, and RFC 8301 explicitly deprecates SHA-1 for DKIM. Any record using
h=sha1 should be treated as insecure.Update your record to use
Check your DKIM record →
h=sha256 and regenerate the key pair through your mail provider or ESP.
Warning
Testing mode left on (t=y)
The
t=y flag tells receivers your domain is testing DKIM and to treat failures leniently. Left on in production, it undermines the protection DKIM is meant to provide.Remove
t=y from the DKIM record once you have confirmed signing works correctly.
Warning
No service type flag
Without an
s=email flag the key is not restricted to email signing only - it can theoretically be used for other services, widening your attack surface.Add
s=email to your DKIM TXT record to restrict the key to email signing (RFC 6376 best practice).DKIM Signing Algorithm Comparison
Not all DKIM configurations are equally secure. Here is how the common key types compare on security, performance, and adoption.
| Algorithm | Key size | Security status | Performance | Recommendation |
|---|---|---|---|---|
| RSA-1024 | 1024-bit | Deprecated | Fast signing | Upgrade immediately |
| RSA-2048 | 2048-bit | Acceptable | Moderate | Recommended minimum |
| RSA-4096 | 4096-bit | Strong | Slower signing | Good for high-security use |
| Ed25519 | 256-bit (EC) | Best practice | Fastest | Modern best practice (RFC 8463) |
Frequently asked questions
What is a DKIM selector and how do I find mine?
A DKIM selector is a short label that identifies which public key to use when verifying a DKIM signature. It appears in the
s= tag of the DKIM-Signature header of any outgoing email. To find yours, open the raw headers of an email sent from your domain and look for s=. Common selectors include default, google, s1, selector1, and k1. Leave the selector blank here and we will auto-detect the common ones.How often should I rotate my DKIM keys?
Best practice is to rotate DKIM keys every 3-6 months: generate a new key pair, publish the new public key under a new selector, wait 48 hours for DNS propagation, switch your mail server to sign with the new private key, then remove the old selector's record. Note that DNS cannot reveal when a key was created, so this tool cannot show a key's age - track rotation with PowerDMARC DKIM analytics.
Why is RSA-1024 considered dangerous?
RSA-1024 can be factored with academic-grade compute clusters and is increasingly within reach of well-resourced attackers. NIST deprecated 1024-bit RSA in 2013, and Google began warning senders using 1024-bit DKIM keys in 2023. If an attacker factors your 1024-bit private key, they can forge DKIM signatures for any email appearing to come from your domain. Use at least RSA-2048, or Ed25519.
What is Ed25519 and should I switch to it?
Ed25519 is an elliptic-curve signature algorithm defined in RFC 8463 for DKIM. A 256-bit Ed25519 key provides security comparable to a ~3000-bit RSA key, signs and verifies faster, and keeps DNS records compact. The main consideration is compatibility - not every mail server supports RFC 8463 yet. If your infrastructure supports it, Ed25519 is the modern best practice; many organizations run RSA-2048 and Ed25519 selectors side by side.
What does a DKIM key strength score mean?
The 0-100 score reflects the cryptographic strength of your DKIM key as far as DNS can reveal it: key length, algorithm, hash function, the s=email service flag, the t= testing flag, and TTL. Bands are 0-20 Critical, 21-40 Weak, 41-65 Good, 66-85 Strong, 86-100 Excellent. It is a quick indicator - always review the individual checks and recommendations for specific fixes.
Automate DKIM monitoring across all your domains
PowerDMARC tracks DKIM signing health, key strength, and selector status in one dashboard - with alerts the moment a signature fails or a key weakens.
