Skip to content
| Write for Us
SafeNetworkHub - Your Guide to a Safer Digital World
Cryptographic Email Authentication

DKIM Checker & Key Verification

Verify public DomainKeys Identified Mail (DKIM) TXT records and cryptographic selector keys in real time. Validate RSA key length (1024 vs 2048+ bit), canonicalization algorithms, and signature alignment to prevent email tampering and spoofing.

RFC 6376 Standards-Compliant DKIM Cryptographic Validator
Audits Selector TXT Syntax, Public Key Exponent, and Modulus
Evaluates Weak 1024-bit Keys and Missing Revocation Flags
ℹ️ Scope & Limitation Notice: Queries authoritative public DNS TXT records for the specified selector; does not inspect private keys or read inbound email mailboxes.
Launch Tool How It Works & Guide
DKIM Validation Process
RFC 6376 Protocol
1 Selector Query
Fetch selector._domainkey.domain.com TXT Record
2 Key Parser
Validate v=DKIM1; k=rsa; p=PublicKeyBase64 String
3 Key Strength
Check RSA Modulus Size (>= 2048-bit Recommended)
Mode: Local Browser Sandbox Sample Preview

Check a DKIM Record

Public DNS Query

Enter the email domain and DKIM selector used by your mail provider or sending service.

Example: Domain: example.com, Selector: google → google._domainkey.example.com
❓ Where Can I Find My DKIM Selector? ▼

The selector is provided by the email system or service that signs your outgoing mail. Common ways to find it:

  • Email provider settings (Google Workspace Admin, Microsoft 365 Defender, SendGrid, Mailgun, Postmark).
  • DNS dashboard: look for TXT or CNAME records containing "._domainkey".
  • Inspect an email: view raw headers of a sent email and look for the "s=" tag in the DKIM-Signature header.
🔒

Privacy Note: SafeNetworkHub uses the submitted domain and selector only to perform the requested public DNS lookup. Results should not be stored permanently.

FUNCTIONAL ARCHITECTURE

What Does the DKIM Checker Do?

The DKIM Checker executes a real-time DNS lookup for any domain and DKIM selector to verify the integrity and cryptographic strength of its public signing key. It verifies whether the DNS TXT record is formatted according to RFC 6376, flags deprecated 1024-bit RSA keys, and checks for common syntax errors.

By confirming valid DKIM deployment, email administrators ensure that outbound emails signed by their sending servers (Google Workspace, Microsoft 365, SendGrid, Amazon SES) pass DMARC alignment and avoid spam folder rejections.

STEP-BY-STEP METHODOLOGY

How the DKIM Checker Works

1

DNS TXT Selector Query

Constructs the authoritative query for "[selector]._domainkey.[domain]" to retrieve published public key tags.

2

Tag-Value Pair Parsing

Parses mandatory and optional tags including version ("v=DKIM1"), key type ("k=rsa"), and public key data ("p=").

3

Cryptographic Strength Analysis

Calculates the public key modulus length in bits, flagging deprecated or vulnerable 1024-bit keys.

4

DMARC Alignment Verification

Validates that the DKIM signing domain aligns in relaxed or strict mode with the RFC 5322 From domain.

GEO Methodology Declaration: This tool performs authoritative DNS TXT queries against the RFC 6376 selector._domainkey syntax to validate public RSA email signing keys.
DECISION MATRIX

How to Interpret DKIM Checker Results

Result / Status Technical Meaning Recommended Action
Valid 2048-bit Key Modern, cryptographically sound DKIM record properly published and ready for strict DMARC alignment. Maintain automated key rotation schedules every 6 to 12 months.
Warning: 1024-bit Key Record is valid, but 1024-bit RSA keys are considered computationally weak and flagged by modern receiving gateways. Generate a new 2048-bit key pair in your email provider and update DNS records.
Error: Missing or Malformed Record The selector does not exist or contains invalid characters, causing receiving mail servers to fail DKIM checks. Verify selector spelling, ensure double quotes are not escaped incorrectly, and republish DNS TXT record.
TECHNICAL FOUNDATION

How DKIM Signatures Prevent Man-in-the-Middle Email Tampering

DomainKeys Identified Mail (DKIM), formalized in RFC 6376, provides asymmetric cryptographic proof that an email message was genuinely transmitted by the domain owner and has not been altered in transit. When a mail transfer agent (MTA) sends an email, it computes a hash of the email headers and body, encrypts that hash using its private key, and embeds the resulting signature in the "DKIM-Signature" header.

The recipient mail server extracts the selector and domain from the header, queries public DNS for the corresponding public key at "selector._domainkey.domain", and decrypts the signature. If the decrypted hash matches the recomputed message hash, the receiving server proves two critical facts: the sender possessed the private key, and no intermediary modified the message contents or critical headers (Subject, From, To) during transit.

OPERATIONAL PRACTICES

Real-World Use Cases for DKIM Checker

Email Deliverability Specialist

Diagnose Spam Folder Landings

Confirms outbound marketing emails pass DKIM validation across Gmail, Yahoo, and Outlook receiving filters.

Systems Administrator

Verify Post-Migration DNS Keys

Validates that new selectors for transactional email relays (Mailgun, Postmark) resolve accurately before switching MX routes.

Security Operations Analyst

Investigate Phishing & Spoofing Incidents

Verifies whether a spoofed brand domain had a legitimate DKIM key published or failed receiver validation.

TRANSPARENT BOUNDARIES

Limitations of the DKIM Checker

Maintaining an accurate threat model requires understanding what external point-in-time tools can and cannot evaluate:

  • ⚠️ Requires knowing the specific selector name (e.g., "google", "s1", "k1"); DNS does not support wildcard enumeration of all active selectors.
  • ⚠️ Validates the public key published in DNS; cannot inspect the sending server's private key or verify internal signature computation.
  • ⚠️ DKIM alone does not enforce message rejection if SPF fails; robust protection requires paired DMARC policy enforcement.
EXPERT FAQS

Frequently Asked Questions: DKIM Checker

What is a DKIM selector and where is it found? +
A selector is an arbitrary string chosen by the email sender (e.g., "google", "k1", "default") to distinguish between multiple public keys. It is found in the "s=" tag of an email's DKIM-Signature header.
Why are 1024-bit DKIM keys being phased out? +
Due to advancements in cloud compute capabilities, 1024-bit RSA keys are vulnerable to factorization by determined adversaries. Major providers like Google and Yahoo now mandate 2048-bit keys for bulk email senders.
Can a domain have multiple DKIM selectors simultaneously? +
Yes. Domains routinely use distinct selectors for different services—for example, "google" for corporate email, "s1" for marketing newsletters, and "ses" for transactional system alerts.
What happens if a DKIM record has an empty public key tag (p=)? +
An empty public key tag ("p=") indicates that the key has been revoked. Receiving mail servers will treat any signatures generated with that selector as permanently invalid.
PRIMARY REFERENCES

Authoritative Standards & Technical References

This tool operates in direct accordance with verified cybersecurity standards and technical specifications established by authoritative primary institutions:

IETF

RFC 6376: DomainKeys Identified Mail (DKIM) Signatures

The foundational Internet engineering standard defining DKIM cryptographic signing and DNS key publication.

M3AAWG

M3AAWG Best Practices for DKIM Key Management

Industry consortium guidelines on DKIM key size, rotation cycles, and selector governance.

Cybersecurity Navigation & Assessment Hub

Connect into related diagnostic engines, calculators, compliance generators, and foundational cybersecurity architectures across SafeNetworkHub:

explore network security tools Related Tool dmarc checker Related Tool spf checker Related Tool email security checker Related Tool email security protocol assessment Related Tool dns and email security checker Related Tool dns security checker Related Tool dnssec checker Related Tool security headers checker Related Tool tls version checker Related Tool data breach cost calculator Related Tool