A DKIM checker that decodes the key, not just the record
This DKIM checker looks up the public key a domain publishes for DomainKeys Identified Mail at selector._domainkey.domain, follows any CNAME to your mail provider, and decodes the key itself. You see the algorithm, the exact RSA modulus size or the Ed25519 key, and every tag explained — with clear flags for revoked keys, testing mode, SHA-1-only keys and keys too short to count.
The selector is the s= value in the DKIM-Signature header of a message you sent. If you do not know it, paste the headers of a message and the tool fills in d= and s=, or scan 21 selector names that Google Workspace, Microsoft 365, Mailchimp, SendGrid, Fastmail, Postmark and hosting panels use. Rules come from RFC 6376 (September 2011), RFC 8301 (January 2018) and RFC 8463 (September 2018).
How to use the DKIM Record Checker
- Enter your domain and the selector, then press “Check DKIM”.
- No selector? Open “Paste a DKIM-Signature header”, paste a message’s headers, and the domain and selector are filled in for you.
- Or press “Scan common selectors” to try 21 well-known names four at a time.
- Read the key summary — algorithm, size, exponent — and the checks below it; each problem comes with a fix.
- Press “Copy report” to send the result to whoever manages your DNS.
DKIM Record Checker features
Real key decoding
The base64 key is parsed as DER, so the RSA size is the true modulus length (2048, 1024…), not a guess from the text length. Bare PKCS #1 keys are recognised too.
RFC 8301 and 8463 checks
Keys under 1,024 bits fail, 1,024-bit keys get a warning, h=sha1 is flagged, and Ed25519 keys must be the bare 32-byte form.
Selector scan
21 documented or common selector names, queried with at most four requests in flight, with the provider that uses each name.
Header paste
Folded DKIM-Signature headers are unfolded and every signature’s d=, s= and algorithm is listed.
CNAME delegation
Microsoft 365 and SendGrid publish keys behind CNAMEs; the chain is shown so you know who controls the key.
Reading a DKIM key record
A typical record looks like v=DKIM1; k=rsa; p=MIIBIjANBgkqh…IDAQAB. The p= value is a base64 SubjectPublicKeyInfo structure; this checker decodes it and reports, for example, “2048-bit RSA key”, public exponent 65537 and the first and last bytes of the modulus. A 2048-bit key is about 392 base64 characters, longer than the 255-character limit of one TXT string, so it is published as two strings that receivers join without spaces — the tool joins them the same way.
For the Ed25519 example key in RFC 8463 Appendix A.2, v=DKIM1; k=ed25519; p=11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo=, the checker shows the 32-byte public key d75a9801…f707511a — the RFC 8032 test vector it came from.
| Tag | Meaning | Notes |
|---|---|---|
| v= | Version | Optional, must be DKIM1 and come first |
| k= | Key type | rsa (default) or ed25519 |
| p= | Public key | Required; empty means revoked |
| h= | Hash algorithms | sha256 only — sha1 is historic since RFC 8301 |
| t= | Flags | y = testing, s = strict i= domain |
| s= | Service type | * or email |
Where providers publish DKIM (checked 14 October 2026)
- Google Workspace: selector
googleby default, as a TXT record you generate in the Admin console. - Microsoft 365: CNAMEs
selector1andselector2; domains added since May 2025 point to…dkim.mail.microsoft, older ones to….onmicrosoft.com. - Mailchimp: CNAMEs such as
k2; Mailchimp Transactional:mte1andmte2; SendGrid:s1ands2; Fastmail:fm1–fm3; Postmark:pm. - Amazon SES Easy DKIM generates its own selector names (published as CNAME records) that no scan can guess — copy them from the SES console.
DKIM Record Checker FAQ
How do I find my DKIM selector?
Open a message you sent, view its original source, and find the DKIM-Signature header: s= is the selector and d= is the domain. Paste the header into this DKIM checker and it reads both for you. Your provider’s DKIM settings page also shows it.
Is a 1024-bit DKIM key still OK?
It still verifies — RFC 8301 sets 1,024 bits as the minimum — but the same RFC says signers should use at least 2,048 bits. Rotate to a 2048-bit key under a new selector, publish it, switch signing over, then revoke the old selector by emptying its p= value.
What does an empty p= mean?
The key is revoked. Mail signed with that selector fails DKIM. That is the correct way to retire an old selector, but if your mail server still signs with it, every message fails DKIM.
Why does my DKIM record have t=y?
It marks the domain as testing DKIM. Receivers must treat your mail like unsigned mail even when the signature is valid, so it does not help DMARC. Remove t=y once signing works.
Should I use Ed25519 for DKIM?
Ed25519 keys are short and strong, but not every receiver verifies them yet. RFC 8463 suggests signing each message twice — once with RSA and once with Ed25519 — under two selectors.
Is this DKIM checker private?
Only the DNS name and record type are sent, to Google Public DNS over HTTPS (Cloudflare as a fallback). Keys are decoded in your browser and pasted headers stay on this page. To check the rest of your email setup use the SPF Checker and DMARC Checker; for other records, the DNS Lookup.