DKIM keys are published under a selector name, and a checker can only find keys for selectors it guesses. Find your selector in your email provider's admin panel or in a sent message's DKIM-Signature header (the s= tag), then check again.
Where the selector is
| Provider | Default selector |
|---|---|
| Google Workspace | |
| Microsoft 365 | selector1, selector2 |
| Zoho | zoho or custom |
| Mailchimp | k1, k2, k3 |
| SendGrid | s1, s2 |
| Amazon SES | three random tokens |
From a sent message
Open a message you sent in Gmail, choose Show original, and look for DKIM-Signature. The s= tag is the selector and d= is the signing domain. If d= is not your domain, your provider is signing with theirs and your DMARC will not align.
Check it
Enter the selector in the optional field on the domain check. A valid key shows a p= value; an empty p= means the key was revoked.
Live SPF, DKIM, DMARC and MX lookup with raw records and plain-English fixes.
Questions
Why does Gmail say DKIM pass but the checker finds nothing?
The checker guessed the wrong selector. Enter yours and it will find the key.
Is a 1024-bit DKIM key still acceptable?
It works, but 2048-bit is the recommendation and some receivers score 1024 lower. Rotate when you can.