Check the public DKIM key for a selector you know, including key structure and strength.
Your DNS query is sent to Sky’s server and its fixed public resolver to complete the lookup. It is not added to tool history. Ordinary hosting access logs may still exist.
DKIM Checker looks up the public key for one signing domain and selector, then checks its structure and strength. It does not verify a message’s DKIM signature.
Use d= for the domain and s= for the selector in a DKIM-Signature header, or copy them from your provider’s setup. Enter a domain, not a URL or email address. This tool checks one exact selector; it does not discover selectors.
The tool queries selector._domainkey.domain as a TXT record. For example, selector1 and example.com produce selector1._domainkey.example.com. The result shows Domain, Selector, and Queried DNS name; returned text appears under Published records.
Valid record means a supported key structure was parsed. Review needed means an RSA key is below 2048 bits. Not found means no key was returned for that selector. Key revoked means p= is empty. Invalid record signals a record issue; Invalid input means correct the domain or selector. Unavailable means the lookup failed, not that the key is missing.
The page says “Message authentication: Not evaluated.” A published key does not show that a sender used it or that a message passed DKIM. Use a message header or receiver result to investigate a specific email.
Usual cause: The selector may be misspelled, or the domain and selector may not match the signing setup. The tool checks only the displayed DNS name.
Fix: Copy s= from a DKIM-Signature header or provider setup. Confirm d=, then ask your DNS administrator to check the TXT record at the displayed name.
Usual cause: The checker flags 1024–2047-bit RSA keys as Review needed and rejects keys below 1024 bits. RFC 8301 sets a 1024-bit signer minimum and recommends 2048 bits or more.
Fix: Ask your provider about issuing a 2048-bit key before changing a live record. Gmail requires 1024 bits or longer for personal Gmail accounts and recommends 2048 bits if supported.
Usual cause: The record has an empty p= value. DKIM defines this as revoking the public key.
Fix: If the selector should still sign mail, coordinate a replacement key and matching sender setup with your provider. If revocation was intentional, do not restore the old key just to clear the result.
Usual cause: The TXT value may contain malformed tags or key data, or DNS may return multiple TXT records at the selector name. The checker will not choose one.
Fix: Copy the complete provider-issued DKIM record and correct its DNS value with your administrator. Keep one intended TXT record at that name, then check again.
Usual cause: This checker supports RSA and Ed25519, not every declared key type. Not assessed does not mean the key is invalid.
Fix: Confirm the type and selector with your provider. RFC 8463 defines Ed25519-SHA256 for DKIM; for another type, ask the provider or use a checker that supports it.
Usual cause: The DNS resolver timed out or returned an unusable response. This does not prove the record is absent.
Fix: Retry later. If the issue continues, ask your DNS administrator to check TXT resolution for the exact queried name.
Signing domain: example.com; selector: selector1; queried name: selector1._domainkey.example.comThis is the TXT name the checker queries. Valid record means the public key has a supported structure; it does not test a message, private key, or whether signed content changed.
Find s= in a recent message’s DKIM-Signature header; its value is the selector. Your provider’s domain-authentication settings may also show it. Match it with the d= signing domain.
The exact selector._domainkey.domain name may lack a TXT answer. Check spelling and the signing domain, then compare the published record with Queried DNS name. Unavailable means retry; no conclusion was reached.
RFC 8301 requires signers to use at least 1024-bit RSA keys and recommends 2048 bits or more. Gmail requires at least 1024 bits for personal accounts and recommends 2048 bits if supported. This checker flags 1024-bit keys for review.
The key is revoked, not usable. If a sender still uses that selector, coordinate a replacement key and configuration with the provider.