Sign inMonitor a domain

Is DKIM set up for my domain, and is the key strong enough?

DKIM keys live at <selector>._domainkey.<your domain>, and the selector can be anything your provider chose. We try the common ones; if you know yours (it’s the s= value in a message’s DKIM-Signature header), add it.

Selectors we try

26
SelectorWhere you’ll usually see it
google._domainkeyGoogle Workspace default
selector1._domainkeyMicrosoft 365
selector2._domainkeyMicrosoft 365
k1._domainkeyMailchimp / Mandrill
k2._domainkeyMailchimp
k3._domainkeyMailchimp
s1._domainkeySendGrid
s2._domainkeySendGrid
m1._domainkeySendGrid (automated security off)
default._domainkeycPanel and many hosts
mxvault._domainkeyseen on GoDaddy-hosted mail
zmail._domainkeyZoho Mail (common choice)
zoho._domainkeyZoho Mail (common choice)
protonmail._domainkeyProton Mail
protonmail2._domainkeyProton Mail
protonmail3._domainkeyProton Mail
fm1._domainkeyFastmail
fm2._domainkeyFastmail
fm3._domainkeyFastmail
mesmtp._domainkeyFastmail
sig1._domainkeyiCloud+ custom domains
mailjet._domainkeyseen on Mailjet setups
smtp._domainkeygeneric
mx._domainkeygeneric
dkim._domainkeygeneric
mail._domainkeygeneric

Common defaults only; your provider may use another. Key sizes per RFC 8301 (RSA at least 1024 bits) and Google’s guidance (2048 recommended).

Sources

  1. RFC 6376: DKIM signatures · checked 5 Oct 2026
  2. RFC 8301: cryptographic algorithm and key usage update to DKIM · checked 5 Oct 2026
  3. Google: Email sender guidelines (DKIM key length) · checked 5 Oct 2026

Related tools

Domain Health Report Everything at once, graded, with the fixSPF checker Include tree and the 10-lookup limitDMARC checker RFC 9989 tree walk and policyMTA-STS and TLS-RPT Policy file and reportsDMARC report reader Parsed in your browserDNS lookup Any record, with TTLs explainedWHOIS / RDAP Registrar, expiry, status codes