Free tool
DKIM record checker
Look up a DKIM public key by domain and selector, and check its tags, key type and key size against the standard.
What it checks
What this checker looks at.
- Reads the TXT record at selector._domainkey.domain. You supply the selector: it is the s= value in the DKIM-Signature header of a mail you sent. The checker does not guess or discover selectors.
- Checks the tags: v= first and equal to DKIM1, no tag repeated, a p= tag present, k= rsa or ed25519, s= covering email, and h= not limited to sha1. It also reports the t=y testing flag.
- Decodes the key in p=. An empty value means the key is revoked, an RSA key is measured in bits, and an ed25519 key must be the raw 32-byte key.
- It checks the published key only. It does not verify a signed message, so it cannot tell whether your mail is signed with the matching private key.
Common problems
How to fix what it finds.
Find your selector
Open the headers of a mail you sent and find the DKIM-Signature header. Its d= value is the domain and its s= value is the selector to enter here.
Use a 2048-bit RSA key
Receivers must not accept signatures made with keys shorter than 1024 bits, so 1024 bits is the minimum. Generate 2048-bit keys for anything new.
Rotate with a new selector
Publish the new key under a new selector, switch signing to it, and only then retire the old selector. Keep the old key published for a while, because mail signed with it may still be in transit or checked again later.
A long key can be split into several strings
A 2048-bit key is longer than one TXT string allows, so DNS tools split it into several strings within one record. Receivers join them back together, and so does this checker.
- More than one DKIM key recordKeep the one key record that matches your signing key and delete the others at this name.
- v= is not the first tagMove v=DKIM1 to the start of the record, or remove it.
- v= is not DKIM1Set the tag to v=DKIM1, or remove it.
- Key revokedIf you still sign with this selector, publish its public key in p=. If it is retired on purpose, make sure your mail is signed with another selector.
- Key data is not usableCopy the public key again from the system that signs your mail, with no characters missing or added.
- Unknown key typeSet k=rsa or k=ed25519 to match the key your mail is signed with, or remove k= for an RSA key.
- RSA key shorter than 1024 bitsGenerate a new 2048-bit key, publish it under a new selector and switch signing to it.
- RSA key is 1024 bitsGenerate a 2048-bit key, publish it under a new selector and switch signing to it before retiring this one.
- Testing modeRemove y from the t= tag once your signatures verify.
- Key in RSAPublicKey formRepublish the same key in SubjectPublicKeyInfo form, which is the base64 text of a PEM file that starts with BEGIN PUBLIC KEY.
- Record is not a valid key recordKeep one copy of each tag, and make sure the record has a p= tag holding the public key.
- h= allows only sha1Remove the h= tag, or set it to h=sha256.
- Key not valid for emailRemove the s= tag, or set it to s=email.
Try it on the free plan.
1,000 emails a month free, no card. Pro is $29 a month for 50,000.