DKIM Validator
Enter a domain and selector to fetch its DKIM record, or paste the record, and check the tags and the public key.
Common selectors are shown above. The exact one is in the s= value of the DKIM-Signature header of a message you sent.
This checks the public key record only. To confirm that mail is actually signed and passes, send a message to a mailbox you control and look for dkim=pass in the message headers.
What is DKIM Validator?
A DKIM validator checks the public key record that receivers use to verify your email signatures. This tool fetches the TXT record at selector._domainkey.yourdomain, or checks a record you paste, and validates the version, key type, base64 public key and flags. It reads the key itself to report the RSA key size, and it flags revoked keys with an empty p tag, keys under 2048 bits, testing mode (t=y) and the obsolete SHA-1 hash. It checks the published key only. To confirm that mail is signed and passes, send a message to a mailbox you control and look for dkim=pass in its headers.
Why use this tool?
- Look up a record by domain and selector, or paste the TXT value.
- Reads the public key itself to report the key type and the RSA key size.
- Flags revoked keys, weak keys, testing mode and the obsolete SHA-1 hash.
- Quick buttons try common selectors such as default, google, selector1, selector2 and s1.
How to use DKIM Validator
- Step 1. Choose Check a domain, enter the domain and the selector, or choose Paste a record and paste the TXT value.
- Step 2. Select Validate DKIM.
- Step 3. Read the verdict, the key size and the table of tags.
- Step 4. Fix any problems in DNS, then check again after the change has propagated.
Common use cases
Important notes
- The selector is the value after s= in the DKIM-Signature header of a message you sent. Common values include default, google, selector1 and selector2.
- An empty p tag means the key has been revoked, and messages signed with it will fail.
- The t=y flag marks the domain as testing DKIM, so receivers may ignore failures. Remove it when you go live.
- This checks the published key only. Send a message to a mailbox you control and look for dkim=pass in its headers to confirm that signing works.
- If your provider uses a CNAME, the lookup follows it to the final TXT record.
More DNS & Website Tools
DKIM Validator FAQ
How do I find my DKIM selector?
Open the headers of an email you sent. In the DKIM-Signature header, the s= value is the selector and d= is the domain.
Why is no DKIM record found?
The selector or domain may be wrong, the record may not be published yet, or it may be a CNAME that has not propagated. Check the exact host name.
What size should a DKIM key be?
2048 bits is recommended. 1024 bits still works but is considered weak, and keys under 1024 bits are not accepted by modern receivers.
What does an empty p tag mean?
The key was revoked on purpose. Signatures made with it will fail, so publish a new key if you still sign with this selector.