DKIM record check
Looks up selector._domainkey for the domain and validates the key record. This checks the published record only; verifying a message signature needs the message itself.
Updated 2026-10-07
What this tool checks
DKIM needs a selector. The check looks up the TXT record at SELECTOR._domainkey.DOMAIN (the selector and domain you give) and validates it.
- It reads the tags of the record and reports syntax errors.
- It decodes the public key and reads the key size from the key itself (the DER structure), instead of guessing from the length of the text. RSA keys under 1024 bits are flagged as weak (RFC 8301).
- It reports a revoked key, which is a record with an empty
ptag. - It reports testing mode (
t=y). - It reports multiple key records for the same selector.
How to read the result
A key record that passes the check is correctly published. It does not show that your mail is signed with this selector, or that signatures verify.
Limitations
- The check does not verify signatures in messages.
- A selector that is not found says nothing about other selectors on the domain.
- Only the selector you give is checked. The tool does not search for selectors.
Use it from code
API reference for DKIM record check
curl -i "https://api.probekit.dev/v1/mail/dkim?domain=example.com&selector=selector1"A request without payment is answered with 402 Payment Required and the exact price. See the API reference.
Limits
| Input | Domain, DKIM selector |
|---|---|
| Deadline | 10 seconds |
| Freshness | Up to 5 minutes, never longer than the record TTL |
| Price | $0.01 per check |
Findings this tool can report
DKIM (7)
- Error
DKIM_INVALID_KEYThe DKIM public key is not valid base64. - Warning
DKIM_KEY_REVOKEDThe DKIM key for this selector is revoked (empty p tag). - Error
DKIM_MULTIPLE_RECORDSMore than one DKIM record was found for the selector. - Warning
DKIM_NOT_FOUNDNo DKIM key was found for the given selector. - Error
DKIM_SYNTAX_ERRORThe DKIM record contains a tag that cannot be parsed or has an invalid value. - Info
DKIM_TESTING_MODEThe DKIM record is in testing mode (t=y). - Warning
DKIM_WEAK_KEYThe RSA key is shorter than 1024 bits.
Frequently asked questions
How do I find my DKIM selector?
Send a message to a mailbox you control and open the full headers. The DKIM-Signature header contains an s= tag with the selector and a d= tag with the signing domain. Your mail provider's documentation also lists the selectors it uses.
What does 'not found' mean?
Only that the selector you entered has no key record under the domain. The domain may use other selectors, so a missing selector is not proof that DKIM is missing.
Is a 1024-bit RSA key a problem?
RFC 8301 requires verifiers to accept keys of at least 1024 bits and says signers should use at least 2048 bits. The check flags RSA keys under 1024 bits as weak.
Does this verify the DKIM signature of an email?
No. Verifying a signature needs the message itself. The check only inspects the published key record.