Check your DKIM keys.
We look for DKIM keys under the selector names common providers use, or under your own. You'll see each key's type and strength, and whether anything needs replacing.
What a DKIM key proves
What DKIM does
DKIM (DomainKeys Identified Mail) signs every message with a private key held by your sending service. Receivers fetch the matching public key from your DNS and check the signature, which proves the message came from you and wasn't changed.
What a selector is
Keys live at selector._domainkey.yourdomain.com, and the selector is a name the sending service picks: google for Google Workspace, selector1 for Microsoft 365, k1 for Mailchimp, s1 for SendGrid. One domain can have several keys, one per service.
Key strength
2048-bit RSA keys are the current standard. 1024-bit keys still work but are due for replacement, and anything shorter is rejected by major mailbox providers.