📧 DKIM · record inspector

Check DomainKeys Identified Mail records — validate email authentication
ⓘ Common: google, selector1, default, 2023
📧
Enter a domain and selector, then click "Check DKIM"
DKIM records help verify email authenticity and prevent spoofing.
🔐 DKIM = DomainKeys Identified Mail 📝 Format: selector._domainkey.domain.com TXT ⚡ Using Google DNS over HTTPS

🔑 Generate DKIM Keys with OpenSSL

Generate a 2048-bit RSA key pair for DKIM:

# 1. Generate private key
openssl genrsa -out dkim-private.pem 2048

# 2. Extract public key (for DNS record)
openssl rsa -in dkim-private.pem -pubout -outform PEM 2>/dev/null | grep -v "BEGIN" | grep -v "END" | tr -d '\n' | awk '{print "p=" $0}'

# 3. Sample DKIM TXT record
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4xUT9...

⚡ The public key (p= tag) goes in your DNS TXT record at: selector._domainkey.yourdomain.com

📊 Key Size Recommendations

Key Size Security DNS Record Size Recommendation
1024-bit ⚠️ Weak ~180 chars ❌ Avoid - deprecated
2048-bit ✅ Strong ~350 chars ✅ Recommended
3072-bit 🔒 Very Strong ~500 chars 👍 For high security

⚠️ Note: DNS TXT records have a 512-byte limit. 4096-bit keys may exceed this limit.

📋 DKIM Best Practices (2026)

  • 🔑
    Use 2048-bit keys minimum
    1024-bit is considered weak and may be rejected by some receivers
  • 🔄
    Rotate keys every 6-12 months
    Generate new keys and update DNS before expiring old ones
  • 📝
    Use multiple selectors
    Maintain at least two selectors for smooth key rotation (e.g., selector1, selector2)
  • ⚙️
    Include all required tags
    v=DKIM1, p=[public key] are mandatory. Add h=sha256 for better security
  • 🌐
    Publish DKIM for all sending domains
    Even if you don't send much, it prevents impersonation
  • 📊
    Monitor DKIM alignment with DMARC
    Use DMARC reports to ensure your DKIM is being validated

🔧 DKIM Tag Reference

Tag Required Description
v= ✅ Yes Version - must be "DKIM1"
p= ✅ Yes Public key (base64)
k= ❌ No Key type (rsa is default)
h= ❌ No Hash algorithms (sha256 recommended)
s= ❌ No Service type (email is default)
t= ❌ No Flags (y=testing, s=strict)
🔍
DKIMvalidator.com

Quick DKIM record lookup

📨
Mail Tester

Check your email authentication

🔍
DMARCIAN DKIM Inspector

Advanced DKIM validation

📊
DKIM Checker

Alternative validation tool

📚 Command Line Tools

# Generate with OpenSSL (Linux/macOS)
openssl genrsa -out private.pem 2048
openssl rsa -in private.pem -pubout -out public.pem

# Using Python (alternative)
python3 -c "from Crypto.PublicKey import RSA; key = RSA.generate(2048); print(key.export_key().decode()); print(key.publickey().export_key().decode())"