DKIM record checker

It reads a DKIM TXT record (the value at selector._domainkey.yourdomain) and inspects every tag — key type, public key, hash algorithms and flags — then decodes the public key to report its real type and bit length, flagging weak 1024-bit keys, testing mode (t=y) and revoked records (empty p). Everything runs in your browser.

DKIM records live at selector._domainkey.yourdomain.com as TXT records, where the selector is the one your signer uses (for example s1). Enter your domain and selector above and click Look up, or paste the record directly. PowerMTA's selector comes from its domain-key directive.

It works, but 2048-bit is the modern recommendation. 1024-bit keys are considered weak and some providers treat them less favorably. If you're on 1024-bit, rotate to a 2048-bit key — our SPF/DKIM/DMARC generator creates one in your browser.

t=y marks the domain as testing DKIM. Receivers are told to treat signed and unsigned mail the same, so the signature gives you no deliverability benefit. It's useful while validating setup, but remove it for production.