Enter a domain and a selector to look up its DKIM public key record, check for a revoked key and estimate the key length.
DKIM keys are published under a selector, at selector._domainkey.domain, so both parts are needed, there is no way to list a domain's selectors from DNS. Common selectors to try include default, google, selector1, selector2, s1 and k1, and mail providers also name their selector in the headers of messages they sign. The checker looks up the TXT record at that address, parses the v=DKIM1, k= and p= tags, and estimates the RSA key size from the decoded length of the public key in p=. An empty p= value is not a missing key: it means the key has been revoked and signatures using that selector should be treated as failing.
Why does DKIM need a selector? Selectors let a domain publish several keys at once, for example one per mail provider or for key rotation. Each selector is a separate DNS record under _domainkey, and a DKIM signature names the selector it used so a receiver can find the right key.
What does an empty p= tag mean? An empty p= means the public key has been revoked. It is a deliberate published state, not a formatting error, and verifiers should treat signatures for that selector as if the key is no longer valid.
How is the key length estimated? The base64 in p= is decoded in the browser and its byte length is compared with the known sizes of RSA public keys. It is an estimate for the common RSA sizes (1024, 2048 and 4096 bits); the exact size depends on the key encoding.