DKIM Record Checker

What does the tool query?

It requests the TXT records at selector._domainkey.domain through Cloudflare’s DNS-over-HTTPS service and takes the first one that contains p= or starts with v=DKIM1. If you leave the selector blank it uses default, which is rarely a real selector, so Not found is common until you enter the right one. A hit shows the selector, the lookup name, version, key type, a key-size figure and the t and n tags when present.

How do I find my selector?

Open a message your system sent and read the DKIM-Signature header: s= is the selector and d= is the signing domain. Google Workspace uses google by default, and Microsoft 365 uses selector1 and selector2, usually published as CNAME records pointing to Microsoft-hosted names. Other providers generate their own. DNS cannot list selectors, so the tool cannot find one for you.

Does a found record mean my email is signed correctly?

No. It only proves that a public key exists at that name. It does not show that your mail system is signing with the matching private key, that signatures verify, or that the d= domain aligns with your From address for DMARC. To test the whole chain, send a message to a mailbox you control and read its Authentication-Results header.

How does the tool work out the key size?

It decodes the base64 p= value and reads the public key from it. For an RSA key it reports the modulus length, for example RSA 2048-bit key, and for an Ed25519 key (k=ed25519) it reports a 256-bit key. If the value cannot be decoded as a public key, the line says so instead of guessing. A revoked key, with an empty p=, is reported as revoked. 1024 bits is the practical minimum for RSA DKIM keys, and 2048 bits is the usual recommendation.

What does an empty p= mean?

An empty p= value means the key has been revoked, and signatures for that selector will fail verification. The tool reports it as Revoked (empty p= value) in red. It is the correct way to retire a selector deliberately, but it is a problem if you did not intend it.

What do the t flags mean?

The t tag holds flags. t=y means the domain is testing DKIM and receivers should not treat failures as harmful, and t=s restricts the key to the exact signing domain, not its subdomains. The tool prints the raw flags without interpreting them. Remove t=y once DKIM is live in production.

Can it check Ed25519 keys or multiple selectors at once?

It shows the k tag, so an ed25519 key is reported as such, but it applies the same key-length arithmetic regardless of type, so the size line is not meaningful for those keys. It checks one selector per request; run it again for each selector you use.