DKIM Record Checker & Explainer

Paste a DKIM TXT record from Microsoft 365, Google Workspace or any mail provider to get every tag explained, the key type and RSA key length detected, and common problems such as test mode, revoked keys and 1024-bit keys flagged.

Paste a DKIM record

Paste just the TXT value, or the full line with the selector host name (for example from nslookup, dig or Resolve-DnsName). Split strings in quotes are joined automatically.




How to use it
  1. Look up the key: Resolve-DnsName selector1._domainkey.contoso.com -Type TXT (PowerShell), nslookup -type=TXT google._domainkey.example.com or dig +short TXT google._domainkey.example.com. This page does not query DNS itself; paste the result.
  2. Microsoft 365 publishes selector1 and selector2 as CNAMEs that point at Microsoft-hosted keys, so query the selector name and the resolver follows the CNAME. Google Workspace uses the google selector by default; generate a 2048-bit key in the Admin console.
  3. Fix anything marked ERROR first. Remove t=y once mail is passing, and rotate 1024-bit keys to 2048-bit.
  4. The selector name comes from the s= tag of the DKIM-Signature header on a message you sent. Paste the DNS record here, not the header.


Audit hundreds of domains at once
Need SPF, DMARC and MX checks across a whole client list? Run the Bulk SPF / DMARC / MX Auditor on Apify ($2 per 1,000 domains).
Want the full kit?
Runbooks, checklists and helpdesk templates: IT Admin Packs on Gumroad.