DKIM record checker
Look up the TXT record at selector._domainkey.domain and explain the published DKIM key. A signature in a message is not checked.
This one uses a server lookup because the job cannot finish on the device alone.
How to use it
- 1Enter the domain.
- 2Enter the selector from the message's DKIM-Signature s= tag.
- 3Choose Check.
- 4Read whether a v=DKIM1 record is published and whether the public key is empty.
When it helps
- Confirm a new selector is visible in DNS.
- See a revoked selector, which has an empty p= value.
- Read the key type before you compare it with what you published.
Good to know
- This does not verify a DKIM signature or a message.
- A published key does not prove mail will be delivered or rejected.
- Only one selector is queried. Briefed does not guess selector names.
- A public resolver cannot see a private record.
Questions
What is the DNS name?
It is the selector, then ._domainkey., then the domain. For selector s1 and example.com, the name is s1._domainkey.example.com.
Does a record mean the signature is valid?
No. The record is the published public key. This tool does not see a message or check a signature.
Related tools
DMARC record checker DMARC record checker
Read the DMARC policy at _dmarc. This does not prove mail will be delivered.
Email
SPF record checker SPF record checker
Read and explain the SPF policy a domain publishes. This does not prove mail will be delivered.
Email
Email header analyzer Email header analyzer
Paste raw mail headers and read the reported SPF, DKIM, and DMARC results and the Received path.
Email