DKIM Record Checker

This checks DKIM records. It does not verify signatures. A DKIM signature is checked against the public key at selector._domainkey over the canonicalised message body, and this page never has the message — so a result here is a reading of what a signature or key declares, never a statement that a signature holds.

Look up the key a domain publishes

Choose Look up a selector, enter the domain and the selector (the s= value from a DKIM-Signature header), and Quietlytic fetches the TXT record at <selector>._domainkey.<domain> through Cloudflare's DNS-over-HTTPS resolver: whether a key exists, its type and size, whether it is revoked or in testing mode. DNS has no way to list a domain's selectors, so the selector has to come from a real message. Lookups need a one-time bot check and are limited per hour.

What the tags are actually saying

d= is the signing domain, and DMARC alignment compares it against the From header rather than against anything in the signature itself. s= names the DNS selector holding the key. h= lists the headers the signature covers, in order — and anything absent from that list is unsigned and can be altered or added downstream while the signature still verifies.

Two tags that weaken a valid signature

l= limits the signature to the first N octets of the body. Content appended after that point is unsigned and still passes, which is a working mechanism for adding text to a signed message. t=y in a key record marks the domain as testing and instructs verifiers not to treat a failure as meaningful, which means the selector provides no protection at all. Both are flagged here.

Paste both and they are cross-checked

Given a signature and a key record together, the two are compared for internal consistency: key type against signing algorithm, the hash against the key's permitted list, and the key's service type. That is a comparison a person would otherwise do by eye, not a cryptographic check.

A signature with h=to:subject:date and no from is reported as critical — the From address can be replaced without breaking it, which removes the only thing DMARC is aligning. A key record with p= and nothing after it is not broken; an empty p= is how RFC 6376 revokes a key.

DKIM is one of the two passes DMARC accepts; check the policy that relies on it with the DMARC Checker, and the domain's sending list with the SPF Checker.