Skip to content
ToolQivo

DKIM Record Checker

Validate a DKIM public key and read its real key size.

Email Validator Tools Reviews Free · no sign-up

Quick Tool Overview

The DKIM Record Checker validates a public-key record and reads the real RSA key size out of the key itself, catching weak 1024-bit keys, revoked empty keys and forgotten testing flags.

What it does
Validates a DKIM record and measures its key size
You give it
The TXT record from selector._domainkey
You get back
Tag results and the exact key size in bits
Key size read
From the DER structure, not estimated from the string
Best for
Confirming a selector is live, strong and not in testing
Email Validator Tools Free, unlimited use No sign-up Runs in your browser

About the DKIM Record Checker

Paste a DKIM public-key record and this checks every part of it: the version tag and its position, the key type, the public key itself, the hash algorithms allowed, the testing flag and the service type.\n\nThe key size is read out of the key rather than estimated from how long the Base64 is — the DER is parsed and the modulus measured, so a 1024-bit key is identified as exactly that. It matters because 1024-bit DKIM is still extremely common, still technically works, and is treated as weak by a growing number of receivers.

Two failures worth catching on their own: an empty p= tag is the documented way to revoke a key, so a record that looks almost right may be actively telling receivers to fail every signature you make. And t=y leaves the key in testing mode, where receivers are told to ignore a failed signature — fine while you set things up, quietly useless if it is still there a year later.

Key features of the DKIM Record Checker

Exact key size

The modulus is measured, not guessed from the Base64 length.

Revoked keys caught

An empty p= tag fails every signature, and looks almost right.

Testing flag flagged

A forgotten t=y makes DKIM quietly pointless.

Ed25519 supported

Not just RSA — the newer key type is checked too.

Weak algorithms noted

A record still allowing SHA-1 is called out.

How to use the DKIM Record Checker

  1. 1

    Paste your DKIM record

    The TXT value from selector._domainkey at your domain.

  2. 2

    Check the key size

    Read from the key itself — aim for 2048-bit RSA.

  3. 3

    Look for the testing flag

    A t=y flag means receivers ignore failed signatures.

  4. 4

    Confirm the key is present

    An empty p= tag revokes the key entirely.

Frequently asked questions

2048-bit RSA is the current recommendation and what every major provider issues now. 1024-bit still validates almost everywhere but is treated as weak by a growing number of receivers, and anything below that is refused outright.

Reviews of the DKIM Record Checker

What people who use the DKIM Record Checker think of it. Reviews come from visitors and are posted as written.

No ratings yet

Yours would be the first.

  • 5 0 reviews rated 5 stars
  • 4 0 reviews rated 4 stars
  • 3 0 reviews rated 3 stars
  • 2 0 reviews rated 2 stars
  • 1 0 reviews rated 1 star

Write a review

Used this tool? Your rating helps the next person decide.

Your rating

Plain text only — links, email addresses and HTML are not accepted. Your name and review are shown publicly; nothing else is collected. See the privacy policy.

0 reviews

Newest first

No reviews yet

Be the first to rate the DKIM Record Checker. It takes half a minute and no account.

Write the first review

More email validator tools