Security Tools
DKIM Checker
Look up a domain's DKIM public key for a selector and see what each tag in it means.
The selector is in the s= tag of the DKIM-Signature header of a message from the domain.
Worked example
A message from example.com carries a DKIM-Signature header with d=example.com and s=selector1.
Enter example.com and selector1 to fetch the key at selector1._domainkey.example.com. A 2048-bit RSA key is the usual size; an empty p= means the key was revoked, so mail still signed with selector1 fails DKIM.
How it works
The tool fetches the TXT record at <selector>._domainkey.<domain> live over DNS, joins the strings a long key is split into, and parses each tag. It then reads the public key itself to report its type and size, and flags a revoked key, testing mode or a short RSA key.
Learn the theory
FAQ
- What is DKIM?
- DKIM (DomainKeys Identified Mail) lets a sending server sign each message with a private key. The matching public key is published in DNS, so a receiving server can check that the message really came from the domain and wasn't changed on the way.
- Where do I find the selector?
- Open the headers of a message sent from the domain and find the DKIM-Signature header. Its s= tag is the selector and its d= tag is the signing domain. A domain can publish several selectors, for example one per mail service, so there is no way to list them all from DNS.
- What key size should a DKIM key be?
- RFC 8301 says signers must use RSA keys of at least 1024 bits and should use at least 2048 bits. Verifiers reject RSA keys shorter than 1024 bits. Ed25519 keys (RFC 8463) are much shorter and equally strong, but not every receiver supports them yet, so they are usually published alongside an RSA key.
- What does an empty p= tag mean?
- An empty p= value means the key has been revoked. Mail signed with that selector fails DKIM verification, which is the usual way to retire a key after rotating to a new selector.