# DKIM Record Checker

Check a DKIM public key: key type and real key length from the key bytes, testing flags, revoked keys, and discover which common selectors a domain publishes.

Canonical: https://tamperbox.dev/dkim-checker

Reviewed: 2026-10-13

## Capabilities and processing

Enter a domain and selector, or paste a DKIM record. The key is looked up at `<selector>._domainkey.<domain>` by our server; a pasted record is read in your browser.

The key length is measured from the key bytes, not from the record text. The result shows the key type, public exponent, allowed hashes, testing and revoked flags, and a SHA-256 fingerprint to compare with your mail service. Discovery probes 20 common selectors, five at a time.

## Example workflow

harbor-supply.example signs with a 2048-bit key at google. Probe the common selectors to find s1, a 1024-bit key still in testing mode, and open it to see the repairs.

## Limits and interpretation

Selectors are not discoverable from DNS; discovery only finds common names. Find the exact selector in the DKIM-Signature header of a sent message (s= tag). A valid key does not prove that mail is signed with it. The application does not persist tool inputs or results.

## Related tools

[Email Header Analyzer](https://tamperbox.dev/email-header-analyzer) reads reported DKIM results. [DMARC Checker](https://tamperbox.dev/dmarc-checker) inspects the policy that uses aligned SPF or DKIM results.

[All tools](https://tamperbox.dev/) · [Privacy](https://tamperbox.dev/privacy)

## References

[DKIM signatures: RFC 6376](https://www.rfc-editor.org/rfc/rfc6376). This tool inspects public key records; it does not verify message signatures.