DKIM Key Checker

DKIM (DomainKeys Identified Mail, RFC 6376) lets a sender attach a cryptographic signature to outgoing mail. The signing server hashes selected headers and the body and signs them with a private key; the DKIM-Signature header records which headers were covered (the h= tag) and the body hash (bh=). The matching public key is published in DNS as a TXT record at <selector>._domainkey.<domain>, and receivers fetch that key to verify the signature.

A key record is a set of tag=value pairs. v=DKIM1 marks the version, k=rsa (or k=ed25519) names the algorithm, and p= carries the base64-encoded public key. An optional t=y flags testing mode and s=email restricts the key to email. This tool reports whether the record exists and whether the p= field is populated.

Querying selector "google" on example.com might return "v=DKIM1; k=rsa; p=MIGfMA0GCSq...AQAB". The non-empty p= confirms a live RSA key that receivers can use to verify any signature whose header reads s=google; d=example.com. If p= were empty (p=), the key has been revoked per RFC 6376 §3.6.1, and every signature using that selector fails verification.

When DKIM verification fails, the cause is usually one of these record-level issues:

• Empty p= value — the key is revoked and verification fails.
• Querying the wrong selector — each selector is its own record; the s= tag in the message names the correct one.
• A 512- or 768-bit RSA key — too weak; RFC 6376 §3.3.3 recommends 1024–2048 bits.
• A TXT record split or truncated incorrectly — long keys must be quoted strings concatenated, not broken mid-value.

• Where do I find my DKIM selector? — Read the s= tag in the DKIM-Signature header of a message you have already sent.
• Can a domain have multiple DKIM keys? — Yes. Different selectors let you rotate keys or run several signing services at the same time.
• Why does my DKIM pass but DMARC still fails? — DKIM must also align: the signing d= domain has to match the From domain for DMARC to count it.