Skip to content
Open Engine
← All analysers
Technical analysis

DKIM key analyser

Check a DKIM public key's strength, revocation state, and tags.

Short answer

A DKIM selector record is healthy when it carries v=DKIM1, a 2048-bit or stronger RSA key (or Ed25519), no t=y testing flag, and SHA-256 signing. An empty p= tag revokes the selector, which fails every message still signed with it.

Queries selector._domainkey.yourdomain over DNS-over-HTTPS and fills the record in below. The selector is the s= tag in a message's DKIM-Signature header.

Or read it yourself with dig +short TXT selector._domainkey.example.com and paste the value here. Quoted, multi-string records are joined the way a resolver joins them.

Runs entirely in your browser. The key you paste is never sent to a server, logged, or stored — this page has no backend to send it to. If you use Look up, your browser queries Cloudflare's 1.1.1.1 resolver (Google Public DNS as a fallback) over DNS-over-HTTPS; only the domain name is sent, and only when you ask.

Look up a domain or paste a record to see the findings. Nothing is checked until you do.

How to use it

  1. Find the selector in a message's DKIM-Signature header (the s= tag), or press Try common selectors to probe the ones major platforms publish.
  2. Enter the domain and selector and press Look up, or read the key with dig +short TXT selector._domainkey.example.com and paste the whole record.
  3. The analyser decodes the key to report its real bit length.
  4. Rotate anything under 2048 bits using a new selector before revoking the old one.

Frequently asked questions

How is key length determined?

The base64 key is a SubjectPublicKeyInfo structure. The analyser walks its ASN.1 and reads the modulus length directly, so the reported bit count is exact rather than estimated — no network is needed once the record is in the box.

My key shows as revoked — what happened?

An empty p= tag is an explicit revocation. That is correct after a completed rotation and an outage if the selector is still signing mail.

Should I use Ed25519?

Publish it alongside an RSA selector rather than instead of one; verifier support is still incomplete.

Guides that go deeper

More technical analysis

All analysers
Technical analysis

SPF record analyser

Parse an SPF record, count its DNS lookups, and find what will break it.

Runs in your browser
Technical analysis

DMARC record analyser

Grade a DMARC record on enforcement, not just syntax.

Runs in your browser
Technical analysis

Email header analyser

Read authentication, DMARC alignment, and hop-by-hop delays from raw headers.

Runs in your browser