About this tool
Inspect bounded DNS and key-record evidence before connecting a mail provider, rotating selectors, or enforcing DMARC, without mistaking a TXT lookup for end-to-end signature verification.
DKIM Record Checker inspects the bounded TXT RRset that publishes a domain's email signing public key. It builds the selector._domainkey hostname, preserves returned TXT evidence, parses the case-sensitive RFC tag-list, decodes supported key data, and separates missing, revoked, ambiguous, invalid, review, and valid states.
- Builds the selector._domainkey hostname, performs a bounded server-side TXT lookup, concatenates DNS character strings per resource record, and preserves the returned RRset as evidence.
- Parses case-sensitive v, h, k, n, p, s, and t tags, including order, duplicate names, syntax, revoked keys, modern hash support, email service scope, and testing flags.
- Strictly decodes Base64, parses RSA PKCS#1 or SubjectPublicKeyInfo DER to obtain the modulus length, and checks Ed25519 public-key data for the RFC-required 32-byte length.
How to use DKIM Checker
Enter the sending domain and exact selector supplied by your mail provider, then inspect the result. Review candidate count and tag order first, then RSA modulus or Ed25519 byte evidence, p revocation state, h hash restriction, s service scope, t flags, and the raw RRset before changing DNS.
When this tool is useful
- Verify a new mail provider's DKIM selector before sending production email.
- Check selector records during key rotation, provider migration, or DNS cleanup.
- Audit DKIM alongside SPF and DMARC when deliverability or spoofing reports appear.
Practical tips
- Use the exact selector from a DKIM-Signature header or your provider; selectors are not reliably discoverable by guessing common names.
- Keep one DKIM key candidate in a selector TXT RRset so receivers do not encounter ambiguous key evidence.
- Treat a valid static report as a DNS preflight, then verify a real message header and DMARC alignment before retiring an old key.
Examples you can test
Load an example, compare the result with the expected output, then replace it with your own input.
Check a provider selector
Example input
example.com with selector default
Expected output
TXT RRset, candidate count, parsed tag order, key evidence, and RFC findings
Useful after publishing a provider-issued DKIM key and before production signing.
Review key rotation
Example input
example.com with selector selector1
Expected output
Decoded RSA or Ed25519 evidence with revocation and policy status
DNS evidence helps confirm publication, but a signed-message test is still required before removing the old selector.
Validation checklist
- Use the exact selector supplied by the sending provider.
- Confirm exactly one DKIM key candidate exists and v=DKIM1 is first when declared.
- Confirm p contains structurally valid supported key evidence and is not empty or revoked.
- Review RSA modulus guidance or the 32-byte Ed25519 requirement instead of estimating strength from Base64 length.
- Check that h permits sha256, s permits email or *, and t does not leave production in testing mode.
- Verify a real DKIM-Signature and aligned DMARC result before strict enforcement or selector retirement.