DKIM Checker

About DKIM checker

DKIM Checker looks up a domain's DKIM public key for a given selector, decodes it and reports the key type, the RSA modulus size in bits and whether the key is weak, in test mode or revoked. Selectors cannot be listed, so the tool includes shortcuts to the names used by common email providers.

How to use it

1. Enter the sending domain in the Domain box. Its selector goes in the Selector box, which starts as google.
2. If you do not know the selector, look at the DKIM-Signature header of a message you sent and read the s= value, or press one of the suggested selector buttons.
3. Press Check DKIM. A selector button also runs the check straight away for the domain already entered.
4. Read the banner and badge for key type and size, then the Key details table for version, hash algorithms, service types and flags.
5. Follow the Diagnostics list for any problem it found.

A revoked selector

v=DKIM1; k=rsa; p=

The key is reported as revoked. The empty p= is the standard way of retiring a key, so any signature made with this selector now fails, and a Revoked badge appears.

When to use it

• Confirming the DKIM key from your email provider was published in DNS correctly.
• Finding out whether a 1024-bit key should be rotated to 2048 bits.
• Checking that an old selector has been revoked after a provider change.
• Spotting a leftover t=y flag that makes receivers ignore failures.

Questions about DKIM checker

How do I find my selector?

Open the raw source of an email your domain sent and find the DKIM-Signature header. The value after s= is the selector. The buttons cover names such as google, selector1, selector2, k1, k2, s1, s2, dkim and mail.

What key size is acceptable?

Below 1024 bits is reported as an error, since RFC 8301 requires at least 1024 and many receivers reject less. Between 1024 and 2047 bits passes with a warning. 2048 bits is the current recommendation.

What does an empty p= mean?

That the key has been revoked. Every signature created with that selector fails verification. It is correct for a retired key and a problem if your mail server is still signing with it.

What does t=y do?

It marks the key as being in test mode. Receivers must then treat a failed verification as if the message was unsigned, so the key gives no real protection until t=y is removed.

Is this tool run locally?

No. The domain and selector are sent to our server, which queries the record and parses it. Selectors up to 63 characters are accepted, and checks are limited to about 20 per minute.

Related tools

• IP LookupLook up information about an IP address
• DNS LookupLook up DNS records for a domain
• WHOIS LookupLook up WHOIS information for a domain
• PingPing a domain or IP address
• SSL LookupLook up SSL certificate information for a domain
• HTTP Headers LookupLook up HTTP headers for a URL