Free · without registration
Check DKIM record and public key
Check the public DKIM key of your domain for a known selector. Domain and selector can also be transferred locally from a DKIM signature header.
Start of test
Their results
Finding the right DKIM selector
DKIM keys are under selector._domainkey.domain. The selector is in a signed e-mail in the DKIM signature header behind s=, the signature domain behind d=. Alternatively, your mail provider will provide both details in the facility. The tool does not look for common names on suspicion: a domain can have several active selectors of different shipping services.
What the key test evaluates
The DNS response is checked for a unique key record, tag structure, and public key. For RSA, the key is read and its bit length is displayed. RFC 8301 requires at least 1024 bits and recommends at least 2048 bits. For Ed25519, the prescribed length of 32 bytes is checked. An existing but empty p-tag means a revoked key and is shown accordingly.
A key is not yet a valid signature
The DNS record contains only the public part. Whether your mail server is really signed, the message has been changed on the way or the signature matches the visible sender domain cannot be deduced from this. For this, examine an actual received message and its authentication results. This tool does not upload email and does not process a private key.
Avoid errors in installation and rotation
Check Domain and Selector for typos first. When rotating, the new DNS key must be available before sending emails with the new selector. Old keys can still be needed for already sent messages. Follow the specifications of your mail provider. The technical basis shall be: RFC 6376, RFC 8301 and RFC 8463.
Example of classification
At d=example.org and s=mail2026, mail2026._domainkey.example.org is queried. The name of the visible sender and a guessed selector are not enough for this query.
Frequent questions
Is the inserted mailheader transmitted?
No. The reading of d= and s= takes place in the browser. Only domain and selector go to the exam.
Why is no key found despite the DKIM set up?
The selector may not fit, the DNS change is not yet visible everywhere or the provider uses a different signature domain.
Can I use it to verify a DKIM signature?
No. The tool checks the published key, not the signature of a complete message.