Check a DKIM key by its real length, not its label. Find the selectors a domain publishes.
Example
The key
Selectors on this domain
Mail services publish keys under their own selectors. Probing the common ones shows which services sign for the domain.
The record, tag by tag
Findings
Capabilities and processing
Enter a domain and selector, or paste a DKIM record. The key is looked up at <selector>._domainkey.<domain> by our server; a pasted record is read in your browser.
The key length is measured from the key bytes, not from the record text. The result shows the key type, public exponent, allowed hashes, testing and revoked flags, and a SHA-256 fingerprint to compare with your mail service. Discovery probes 20 common selectors, five at a time.
Example workflow
harbor-supply.example signs with a 2048-bit key at google. Probe the common selectors to find s1, a 1024-bit key still in testing mode, and open it to see the repairs.
Limits and interpretation
Selectors are not discoverable from DNS; discovery only finds common names. Find the exact selector in the DKIM-Signature header of a sent message (s= tag). A valid key does not prove that mail is signed with it. The application does not persist tool inputs or results.
Related tools
Email Header Analyzer reads reported DKIM results. DMARC Checker inspects the policy that uses aligned SPF or DKIM results.
References
DKIM signatures: RFC 6376. This tool inspects public key records; it does not verify message signatures.