Free tool · Email auth
DKIM checker, validator + record generator
Three modes: look up the DKIM record at any selector + domain, validate a pasted record string, or generate a fresh RSA keypair with the DNS TXT value formatted ready to publish. No signup.
Common selectors: default, google, k1, selector1, selector2, mail. Look at any email's DKIM-Signature header for the s= tag.
What this tool checks
DKIM (DomainKeys Identified Mail, RFC 6376) signs outbound mail with a private key your MTA holds; receivers verify the signature against the public key you publish in DNS at <selector>._domainkey.<domain>. DKIM is one of the three DMARC alignment paths (alongside SPF) and is the more reliable one because it survives forwarding.
Look up mode: enter the domain and the selector, we resolve the TXT record, parse every tag, and inspect the public key (algorithm, bit length, revocation status).
Validate mode: paste a DKIM record body and we parse it without any DNS lookup. Useful for verifying a record before you publish it, or analyzing a record from DNS history / a backup.
Generate mode: produces a fresh RSA keypair in memory on our server. We return the private key (PEM) for your MTA / signing service config, plus the formatted DNS TXT value ready to publish. Nothing is stored - the keypair is unique to your request and forgotten the moment the response is sent.
How to read the results
What selector should I use? Look at the DKIM-Signature header on any email from the domain. The s=tag is the selector. Common values: Google Workspace = google, Microsoft 365 = selector1 / selector2, Mailgun = k1, Postmark = often the year, e.g. 2024.
Public key bit length: 2048 is the modern default. 1024 still works for most receivers but Gmail and Yahoo have started signalling preference for 2048+. Below 1024 is silently ignored. Above 4096 won't fit in a standard DNS TXT record.
p= empty = revoked. RFC 6376 §3.6.1: a zero-length p= tells receivers to treat the key as revoked. Used when rotating keys - you can keep the old selector live as revoked while transitioning, then remove the record entirely once nothing is signing with it.
t=y means testing. Receivers see this and ignore the signature without affecting your reputation. Useful for staging but a foot-gun in production - remove it once you're confident.