DomainKeys Identified Mail (DKIM) is an email authentication method that uses cryptographic signatures to verify that an email was sent by an authorized server and was not altered in transit.

The sending server signs outgoing emails with a private key. The receiving server looks up the corresponding public key in DNS (via a TXT record under selector._domainkey.domain) and verifies the signature.

Why is DKIM important?

DKIM proves email authenticity and integrity. Without it, anyone can forge emails from your domain. It is also required before DMARC can be effective, since DMARC uses DKIM (or SPF) alignment to validate messages.

How often should I rotate DKIM keys?

Best practice is to rotate DKIM keys every 6-12 months. Use multiple selectors to transition smoothly — publish the new key first, wait for DNS propagation, then update your sending infrastructure.

Is this DKIM lookup free?

Yes, this tool is 100% free with no signup required. For continuous DKIM monitoring, key rotation alerts, and historical record tracking, upgrade to CyberFurl Pro.

How to perform a DKIM lookup?

To perform a DKIM lookup, simply enter your domain name and the DKIM selector in the input fields above. Our tool will automatically query your domain's DNS and retrieve the associated public key.

DKIM Record Lookup & Key Validator

Query and cryptographically validate DomainKeys Identified Mail (DKIM) TXT records. Ensure RFC 6376 compliance, verify RSA/Ed25519 public keys, and debug key sizes or selector misconfigurations.

No signup

Instant results

100% free

What Is DKIM?

Why DKIM Validation Matters

DKIM attaches a cryptographic signature to emails, verifying the sender's domain and ensuring message integrity. Misconfigured selectors, deprecated 1024-bit RSA keys (violating RFC 8301), or improper base64 encoding lead to signature failures, causing emails to fail DMARC evaluation and drop into spam folders. Continuous validation prevents spoofing and ensures reliable inbox placement.

Common DKIM Misconfigurations

Using weak 1024-bit RSA keys instead of ≥ 2048-bit or Ed25519., Exceeding the 255-character UDP DNS limit without proper TXT record chunking., Missing or incorrectly formatted 'p=' (public key) tags in the TXT record..

DKIM_SELECTOR_FOUND

TXT_RECORD_OK

PUB_KEY_FETCHED

SIG_VERIFIED

DKIM_ENGINE_V1

AUTH_PASS

How It Works

Input Domain

Enter the domain and the specific DKIM selector you wish to query.

Click Check

The tool performs a DNS TXT lookup against authoritative nameservers for 'selector._domainkey.domain.com'.

Review Results

It parses the key-value pairs (v, k, p) according to RFC 6376 syntax rules.

Fix & Enforce

Validates the public key length, cryptographic algorithm (RSA/Ed25519), and checks for common formatting errors.

Selector-based Resolution

Accurately resolves DKIM TXT records by querying the exact selector sub-namespace (_domainkey).

Key Length Analysis

Detects RSA keys under 2048 bits, flagging them as insecure per RFC 8301 standards.

Ed25519 Support

Fully supports modern Edwards-curve Digital Signature Algorithm (Ed25519) keys (RFC 8463).

Syntax & Tag Validation

Parses all DKIM tags (v, k, p, h, s, t) to ensure strict adherence to RFC 6376 formatting.

DNS Chunking Support

Properly reconstructs long DKIM keys split across multiple DNS TXT strings exceeding 255 bytes.

Actionable Debugging

Highlights missing public keys, invalid base64 encoding, or revoked keys (p=) instantly.

Frequently Asked Questions

What is a DKIM selector?

A DKIM selector is an arbitrary string appended to the '_domainkey' namespace (e.g., s1._domainkey.example.com). It allows multiple DKIM keys to coexist for a single domain, facilitating key rotation and multi-vendor email sending.

Why is my DKIM record returning a syntax error?

Syntax errors often occur due to improper base64 encoding of the public key (p= tag), missing semicolons between tags, or unsupported key types (k= tag). Ensure strict adherence to RFC 6376.

Is a 1024-bit RSA key secure for DKIM?

No. RFC 8301 formally deprecates 1024-bit RSA keys due to increased vulnerability to factoring attacks. You must use at least 2048-bit RSA keys or switch to Ed25519 (RFC 8463).

What does 'p=' mean in a DKIM record?

The 'p=' tag contains the base64-encoded public key used by the receiving Mail Transfer Agent (MTA) to cryptographically verify the signature attached to the email. If 'p=' is empty, the key is considered revoked.

How do I handle DKIM keys longer than 255 characters?

DNS UDP responses historically limit individual strings to 255 characters. Long DKIM keys (like 2048-bit RSA) must be split into multiple quoted strings within the same TXT record, which the resolver concatenates.

Can I use Ed25519 for DKIM?

Yes, RFC 8463 introduced Ed25519 for DKIM. It provides high security with a much smaller public key size, fitting easily into a single DNS UDP packet, though legacy MTA support may vary.

How often should I rotate my DKIM keys?

M3AAWG and general security best practices recommend rotating DKIM keys every 6 to 12 months to mitigate the risk of key compromise and replay attacks.

Guru Guides

DKIM Signatures

DKIM cryptographic signing is mandatory for Google compliance. Learn key rotation and selectors.

DMARC Enforcement

Stop email spoofing and BEC fraud with DMARC p=reject. Learn SPF/DKIM alignment requirements.

Phishing Threats

Phishing is the #1 ransomware entry point. Learn the technical and human controls that stop them.

Related Security Tools

Verify Your DKIM Cryptography Today

Ensure your emails are cryptographically secure and fully RFC compliant. Use our advanced DKIM Lookup tool to validate your selectors, analyze key strength, and prevent email spoofing instantly.

Start Free Trial View Pricing