Logo

MonoCalc

/

DKIM Record Parser

Networking
Paste the raw DNS TXT record value starting with v=DKIM1 (semicolon-separated tag=value pairs)

About This Tool

DKIM Record Parser – Decode and Inspect DKIM Public Key TXT Records

DKIM (DomainKeys Identified Mail) is one of the three pillars of email authentication, alongside SPF and DMARC. It works by having the sending mail server cryptographically sign outgoing messages, and publishing the corresponding public key in DNS so receiving servers can verify those signatures. The public key lives in a DNS TXT record at a well-known location: {selector}._domainkey.{domain}. This tool parses that record and breaks it down into every structured field so you can quickly understand and audit it.

Anatomy of a DKIM TXT Record

A DKIM public key record is a semicolon-delimited list of tag=value pairs. The most common tags are:

  • v= (Version) — Always DKIM1. Required and must be first if present.
  • k= (Key Type) — The public-key algorithm. Default is rsa;ed25519 is the modern alternative with shorter keys and equivalent security.
  • p= (Public Key) — The base64-encoded DER SubjectPublicKeyInfo of the public key. An empty value (p=) signals that the key has been revoked.
  • h= (Hash Algorithms) — Colon-separated list of acceptable hash algorithms for the signature. RFC 8301 requires sha256; sha1 is deprecated.
  • s= (Service Types) — Restricts the key to specific service types. Defaults to * (all services). Use email to limit the key to email only.
  • t= (Flags) — Colon-separated behaviour flags. t=y means testing mode; t=s enforces strict subdomain checking for the From address.
  • n= (Notes) — An optional human-readable note from the domain owner. Ignored by mail software.

How to Find a DKIM Record

The DKIM selector is embedded in the DKIM-Signature header of any signed message, in the s= field. The signing domain is the d= value in the same header. Combine them: look up TXT records at {selector}._domainkey.{domain}. For example, if a message signed by Google has s=20230601 and d=gmail.com, the DKIM record is at 20230601._domainkey.gmail.com. You can retrieve it with dig TXT 20230601._domainkey.gmail.com or any DNS lookup tool.

RSA Key Size and Security

For RSA keys, larger moduli offer stronger security at the cost of slightly larger DNS records and marginally slower signature verification:

  • Less than 1024 bits — RFC 8301 explicitly deprecates these. Receiving servers may reject or ignore signatures made with short keys.
  • 1024 bits — Still widely used but considered weak. Migration to 2048 bits is strongly recommended.
  • 2048 bits — Current best practice. Fits comfortably in a single DNS TXT record chunk and provides adequate long-term security.
  • 4096 bits — Provides the highest security but may exceed the 512-byte UDP TXT limit, requiring DNS TCP fallback.

Alternatively, Ed25519 keys are only 32 bytes long, fit in every DNS TXT record, and provide security equivalent to a 3000-bit RSA key. Most modern mail transfer agents support Ed25519, though some legacy systems may not.

Key Revocation

When a private signing key is compromised or retired, the domain owner revokes it by removing the base64 content from the p= tag, leaving it empty: p=. Receiving mail servers that fetch the record and see an empty p= value must treat all messages signed with that selector as failing DKIM verification. Revocation takes effect as soon as the DNS change propagates — typically within the TTL of the record.

DKIM in the Broader Email Authentication Stack

DKIM does not by itself prevent phishing — it only proves that the message body and specified headers have not changed since the sender signed them. Its real power comes when combined with SPF (which restricts which servers can send for your domain) and DMARC (which ties SPF and DKIM results to the visible From address and specifies enforcement policy). A domain with all three configured and a p=reject DMARC policy is highly resistant to direct impersonation.

Common Issues Detected by This Parser

Paste your DKIM record and the parser will flag:

  • Revoked keys — empty p= tags that will cause all signatures to fail.
  • Weak RSA key sizes — keys below 2048 bits with a recommendation to rotate.
  • Testing mode — t=y flag that suppresses enforcement and should be removed once setup is complete.
  • Missing sha256 — when the h= tag excludes the required algorithm.
  • Unknown tags — vendor extensions or typos that may be silently ignored by receivers.

Frequently Asked Questions

Is the DKIM Record Parser free?

Yes, DKIM Record Parser is totally free :)

Can I use the DKIM Record Parser offline?

Yes, you can install the webapp as PWA.

Is it safe to use DKIM Record Parser?

Yes, any data related to DKIM Record Parser only stored in your browser (if storage required). You can simply clear browser cache to clear all the stored data. We do not store any data on server.

What is a DKIM record?

A DKIM (DomainKeys Identified Mail) record is a DNS TXT record that publishes the public key used to verify email signatures. When a mail server receives a message, it looks up the DKIM record for the signing domain and selector, then uses the public key to verify the signature in the DKIM-Signature header. A valid signature proves the message body and headers have not been altered in transit.

How does this DKIM Record Parser work?

Paste a DKIM public key TXT record value (the string starting with v=DKIM1) into the input field and click Parse. The tool splits the semicolon-delimited tag=value pairs, identifies each tag, decodes the base64 public key, estimates the RSA key size, and highlights any warnings such as revoked keys, weak key lengths, or testing-mode flags.

Where do I find a DKIM record to parse?

DKIM records are published at a DNS name following the pattern "{selector}._domainkey.{domain}". For example, if the DKIM-Signature header says s=google and d=example.com, the record is at google._domainkey.example.com. You can look it up with a DNS tool by querying TXT records at that hostname, then paste the value here.

What does an empty p= tag mean?

An empty p= tag (p="") means the key has been explicitly revoked by the domain owner. Receiving mail servers that see an empty p= should treat all messages signed with that selector as failing DKIM verification. Key revocation is how domains retire old signing keys without waiting for DNS TTLs to expire.

What RSA key size should I use for DKIM?

RFC 8301 deprecates RSA keys shorter than 1024 bits. A 2048-bit RSA key is the current best practice and is supported by virtually all mail servers. Keys of 4096 bits provide more security but can exceed the 512-byte DNS UDP packet limit for TXT records, requiring TCP fallback. Ed25519 keys are much shorter and provide equivalent or better security than 2048-bit RSA.

What is the t=y flag in a DKIM record?

The t=y flag marks the DKIM key as being in testing mode. According to RFC 6376, receiving mail systems must not treat a failed DKIM signature as a policy failure when this flag is present. It is intended for use while a domain is setting up or rotating DKIM keys to avoid penalising legitimate messages before the configuration is verified. Remove the flag when you are confident the setup is correct.