Updated · Volt Ghost team
Which selectors answered
| Selector | Listed domains with a key there |
|---|---|
default | 273 |
dkim | 157 |
s1 | 62 |
mail | 53 |
google | 48 |
selector1 | 4 |
k1 | 4 |
selector2 | 2 |
Most domains answered on exactly one selector. We left out 19 more domains that answered on all eight with the same text: a wildcard TXT record that matches any name, not a set of keys. Some records are long enough to be split into several strings in DNS; we joined them before reading the key.
Three batches explain much of it
- mail.tm. All 88 domains on its
in.mail.tmserver publish a key underdefault, alongside the strict DMARC policy described on the DMARC page. 57 of them came in one change, "Add mail.tm domains" (#726, 10 September 2025). - temp-mail.org, 22 May 2025 (#593). All 114 domains publish a key under
dkim, with the same configuration repeated on every name. - throwaway.io, 12 October 2026 (#1208). 84 domains have a key, 49 under
s1and 34 underdefault. Although 588 listed domains authorise Microsoft 365 in SPF (most of them from this batch), only 2 answer onselector1, the name Microsoft 365 uses for its DKIM records, so Microsoft signing does not appear to be set up on the rest.
By mail server
| Mail server group | Domains with MX | DKIM key found |
|---|---|---|
Own mail. host on the domain | 1,427 | 318 (22%) |
| mail.tm | 88 | 88 (100%) |
| GPTMail | 1,025 | 17 (2%) |
| Cloudflare Email Routing | 317 | 14 |
| generator.email | 319 | 8 |
| Wabbly/Wally hosts | 341 | 0 |
| Tinyhost | 303 | 0 |
| Everything else | 1,710 | 131 |
Domains that run their own mail. host are far more likely to sign than domains pointed at a shared temp mail server. The big receive-only pools (GPTMail, Tinyhost, Wabbly/Wally) almost never publish a key under these names, which fits services that only receive mail on those domains.
Key sizes
504 of the 592 domains publish only 2048-bit RSA keys. 88 have a 1024-bit key, the minimum RFC 8301 allows; the largest share of those (41) were first listed in 2018, which suggests old setups that were never rotated. We saw no Ed25519 keys under these selectors.
All three records together
493 of the 592 domains with a DKIM key also publish SPF and DMARC, the full set a receiving server looks for. That is 7% of the domains on the list with a working MX record. For comparison, SPF appears on 54% of them and DMARC on 25%.
Using this in practice
To see the selector a sender really used, read the DKIM-Signature header of a message it sent: the email header analyzer shows it, along with the pass or fail result. To check one domain's published key, the SPF, DKIM and DMARC checker tries common selectors or the one you give it. And if you are a developer testing your own app's sign-up or password-reset mail, a throwaway inbox is a quick way to see whether your messages arrive signed; see temp email for testing.
Check one domain
Check one address or domain against the disposable list, or look up its MX records. One name per query.
Questions
Do disposable email domains sign mail with DKIM?
Few publish a key we can find. Probing eight common selectors on 9 November 2026, we found a DKIM key on 592 of 6,723 listed domains with a working MX record. Most temp mail domains only receive mail, so they have little reason to sign.
Why can't you list every DKIM key a domain has?
DKIM keys sit under a selector name chosen by the sender, and DNS has no way to list the names under _domainkey. You can only test guesses, or read the selector from the DKIM-Signature header of a real message.
Is a 1024-bit DKIM key still acceptable?
RFC 8301 requires at least 1024 bits and recommends 2048. 88 of the 592 domains we found publish a 1024-bit key; the rest use 2048 bits.
Does DKIM help tell whether an address is disposable?
No. DKIM proves a message was signed by the domain; it says nothing about who owns the inbox or how long it lasts. A disposable domain check is the right test for that.
