IP e rede

DKIM Checker

Find a domain's DKIM key by selector and check its syntax and key length.

Without a selector we try 30 common ones. The exact selector is in a received message header: DKIM-Signature: … s=selector; d=domain.

Fatos principais

DKIM is a public key in DNS at selector._domainkey.domain that receivers use to verify a message signature. Enter the domain and the selector (it is in the DKIM-Signature header as s=…) or leave it blank and we try 30 common selectors. An RSA 2048-bit key is considered good, under 1024 weak.

Preço
Grátis
Cadastro
Não é necessário
Processamento
On our server: DNS TXT (and CNAME) queries to selector._domainkey.your-domain, tag parsing and a key-length calculation
Entrada
A domain and, optionally, a selector (or paste selector._domainkey.domain in full)
Limites
No sign-up; 12 checks per minute per IP, no daily limit. Without a selector, 30 common ones are tried within about 10 seconds
Resultado
For each selector found: the record, version and key type, RSA key length, flags (such as testing mode) and warnings; a warning for a dangling CNAME
Última atualização

Código aberto no GitHub

Execute a mesma verificação na sua própria máquina: uma ferramenta de linha de comando em Node.js, uma biblioteca e uma GitHub Action. Código aberto sob a licença MIT.

ksanyok/dkim-checker

DKIM record lookup and key check

DKIM signs every message with a domain key, and the receiver verifies the signature against the public key in DNS at selector._domainkey.domain. This tool finds that record for your selector or tries 30 common ones (Google Workspace, Microsoft 365, Mailchimp, SendGrid, Zoho, Fastmail, Proton, HubSpot and more), follows CNAMEs, parses the tags and measures the RSA key length. Selectors cannot be listed via DNS, so "not found" only means "not among the selectors checked".

Check one selector or try 30 common ones
RSA and Ed25519 key length: weak, 1024, 2048+
CNAME delegation and dangling CNAMEs
Revoked keys (empty p=), t=y, h=sha1, broken base64

Como usar

  1. Enter the domain; take the selector from the DKIM-Signature header (s=) if you have it
  2. Without one we try 30 common selectors — it takes a few seconds
  3. Check the key status and replace keys shorter than 2048 bits

FAQ

The selector is the name under which the key sits in DNS: selector._domainkey.domain. It is in the DKIM-Signature header of a received message in the s= field. Google Workspace defaults to “google”, Microsoft 365 uses selector1 and selector2.

That does not mean there is none: DNS cannot enumerate selectors. Open the headers of any message from the domain, find s= in DKIM-Signature and enter that selector.

A sensible minimum today is RSA 2048 bits. Keys under 1024 bits are weak and 1024 should be replaced. Ed25519 is also valid but not every receiver supports it.

The selector points by CNAME at a mail platform, but the target record no longer exists. The signature cannot then be verified and messages using that selector fail the check.

No. That needs the message headers and body. The result recorded by the receiving server can be read in the email header analyzer.

PromoPilot vs. alternativas: comparação

Comparamos apenas o que está confirmado nas páginas de cada serviço. Onde não conseguimos confirmar um dado, a célula mostra "—".

Parâmetro PromoPilot MxToolbox DKIM Lookup dmarcian DKIM Inspector
Looks up a given selector ✓ ✓ domain:selector or the full selector._domainkey.domain host name ✓ domain and selector required
Tries common selectors with no input ✓ 30 selectors Not stated on the page ✗
Key length and warnings ✓ The result format is not described on the page ✓ tag table, warnings/errors and public key length
No sign-up needed ✓ — ✓ a free tool; entered data is not stored (per the site)

Role a tabela para os lados

Onde somos mais fracos: a real message’s signature is not verified, the scan is limited to 30 common selectors and 10 seconds, and there is no alignment check or combined SPF/DMARC report on the same page.

Quando escolher o PromoPilot: When you need to find a domain’s DKIM key or check length and syntax after setting up a mail service. We do not verify the signature of a specific message, and a blind scan may miss a non-standard selector.

Verificado em: . "—" significa que não foi confirmado na página oficial; condições e preços mudam, então confira os sites dos próprios serviços.

Experimente também
Detector de IA
Detector de imagem IA
Verificador SynthID
Detector de marca d'água em imagens
Promoção com links em cascata para o seu site Bônus de $30Backlinks 5→50→5000 em mais de 100 plataformas. A partir de $30 para começar, mais um bônus de $30 para novos usuários.
SEO Radar GrátisQuantos cliques suas páginas nas posições 4–20 estão perdendo Rank Tracker ProMonitoramento diário de posições no Google SEO Audit ProAuditoria técnica do site — 100 páginas grátis