DKIM Checker

Reading a DKIM lookup

DKIM signs a message with a private key you hold and publishes the matching public key in DNS at selector._domainkey.yourdomain. A receiver pulls that key and verifies the signature. This tool fetches the key for a selector, reports its length, and shows the raw record - which is where most problems are visible.

Why does my key work in one checker and not another?

Almost always a TXT value split across multiple strings. DNS limits a single string to 255 characters and a 2048-bit key is longer, so it has to be split - and the two halves must be concatenated with no separator. Some DNS providers add a space or a line break, and a receiver that joins them literally gets an invalid key.

Is a 1024-bit key still acceptable?

Not really. Major providers began refusing 1024-bit signatures outright rather than treating them as unsigned. Use 2048, which is the current baseline; 4096 is supported but the record gets long enough that splitting problems become more likely.

What is a selector and can I change it?

A selector is a label that lets one domain publish several keys at once - s1, s2, mail, and so on. Rotating means publishing the new key under a new selector, waiting for DNS to settle, switching signing to it, then removing the old one. Mail already in flight keeps verifying against the old selector, which is why the order matters.

The key is published but the signature fails. What now?

The key is only half of it. Check that the d= domain in the signature matches the domain you looked up, that the message was not modified in transit by a mailing list or a scanner, and that the headers listed in h= were not rewritten. A relay that appends a footer breaks the body hash while leaving the key perfectly valid.