ToolsEmail

DKIM checker & key generator

Check the public key a domain publishes for a DKIM selector, or try the selectors common providers use. You can also generate a new key pair, made in your browser and never sent anywhere.

Keys checked and made in your browser
Lookups sent via abbott.cloud to Cloudflare DNS

Check a key

Generate a key pair

How this works

Checking a key

Your browser builds the DNS question for the TXT record at selector._domainkey.domain. With no selector, it builds one for each of 27 selectors that common providers use.
Browsers can't send DNS packets themselves, so this page posts them to abbott.cloud/api/dns, which forwards them unchanged to Cloudflare's resolver (1.1.1.1) using DNS over HTTPS. All 27 travel together, in two requests.
This page decodes the answers, reads each tag (RFC 6376 §3.6.1) and decodes the key's DER bytes to find its type and size, which it checks against RFC 8301 and RFC 8463.

Generating a key

Your browser's Web Crypto (crypto.subtle.generateKey) makes the key pair on your device: RSA with exponent 65537, or Ed25519.
This page exports the public key into the DNS record and the private key as PKCS#8 PEM. Nothing is sent, so the request log below stays empty.

What's kept: nothing. The domain and selector you check go in the page's address so you can share the result. Generated keys don't: they exist only on this page until you leave it or generate again.

Limitations:

DNS can't list a domain's selectors, so a selector that isn't common can only be checked by name.
It checks the published key, not a signed message. To check a signature, look at the Authentication-Results header of a message you received.
The Host shown for a new key, such as s1._domainkey.news for news.example.com, assumes the record is edited in the zone of the registered domain (example.com). If the subdomain is a zone of its own, leave out .news.

Code: dkim.js (this page), lib/dkim.js (key records, keys and key pairs), dkimcheck.js (common selectors and the record for a new key), net.js (requests).