H
HTTPSense

DKIM Inspector

Probe DKIM selectors, validate the published public keys, and flag weak, revoked, and test-mode keys.

What is a DKIM Inspector?

A DKIM inspector is a tool that checks a domain's DomainKeys Identified Mail records — the public keys published at <selector>._domainkey.<domain> that receiving mail servers use to verify a message's cryptographic signature. DKIM is a domain-level control defined in RFC 6376: the path of a URL does not matter, only the registered domain. Valid, strong DKIM keys are essential for email deliverability and for preventing tampering and spoofing of your mail.

HTTPSense's DKIM Inspector probes a curated list of common provider selectors, parses every published key record, and validates the underlying RSA or Ed25519 public key. It surfaces problems like insecure or weak key sizes, revoked keys, test-mode flags, invalid syntax, and unknown key types — then assigns a letter grade. Because selectors cannot be listed from DNS, you can supply your own. It's free and requires no signup.

How to Use the DKIM Inspector

  1. Enter a domain name or URL in the search bar and click Inspect DKIM.
  2. Optionally add your provider's custom selectors (comma or space separated) before running.
  3. Review the Selectors tab to see which probed selectors returned a published key.
  4. Open the Key Detail tab to inspect each key's type, size, hash algorithms, and SHA-256 fingerprint.
  5. Check the Findings tab for severity-ranked issues — weak keys, revoked keys, test mode — each with a fix.
  6. Use the Custom Selectors tab to re-run against selectors not in the default list, then the Raw tab to copy or download the JSON.

How the DKIM Inspector Works

When you submit a domain or URL, we strip the scheme, port, and path to extract the bare hostname. Because DNS provides no way to enumerate a domain's DKIM selectors, we query <selector>._domainkey.<domain> for a curated list of common provider selectors in parallel through Cloudflare's public resolver (1.1.1.1), plus any custom selectors you supply.

Each TXT record that is returned is parsed against the DKIM key grammar — the version (v), key type (k), public key (p), flags (t), service types (s), and permitted hash algorithms (h). We decode the public key, parse it as an RSA or Ed25519 key, measure its bit length, and compute a SHA-256 fingerprint. An empty p= marks a revoked key and a t=y flag marks test mode.

Finally we evaluate a findings catalog — insecure keys below 1024 bits, weak 1024-bit keys, revoked keys, test-mode keys, invalid syntax, unknown key types, and wildcard hash lists — and translate them into a 0–100 score and an A–F grade. We do not send any email or probe SMTP; the analysis is purely DNS-based.

Key Features

  • Parallel selector probing — Checks a curated list of common provider selectors at once.
  • Custom selectors — Add the exact selector your mail provider signs with and re-run.
  • Public-key validation — Parses RSA and Ed25519 keys, measures bit length, and computes a SHA-256 fingerprint.
  • Weak & insecure detection — Flags keys under 1024 bits and recommends 2048-bit upgrades.
  • Revoked & test-mode flags — Surfaces empty p= revocations and t=y test keys.
  • Findings & remediation — Severity-ranked issues, each with a concrete fix.
  • Scored grade & raw JSON — A 0–100 score mapped to an A–F grade, plus the full response for scripting.

Common Use Cases

  • Email administrators — Confirm a new sending service published its DKIM key before going live.
  • DevOps engineers — Audit DKIM keys when onboarding an ESP or rotating keys.
  • Security engineers — Catch weak, revoked, or test-mode keys that weaken signing.
  • Deliverability specialists — Verify signing keys are valid and strong to protect inbox placement.

Frequently Asked Questions

What is a DKIM selector?

A selector is the label that identifies which DKIM key to use. The public key lives at <selector>._domainkey.<domain> as a TXT record, so a message signed with selector "google" is verified against google._domainkey.example.com. A domain can publish many selectors — one per sending service — and rotate them over time. Because there is no way to list a domain’s selectors from DNS, the Inspector probes a curated list of common provider selectors and lets you add your own.

Why does the Inspector say no DKIM keys were found?

DKIM selectors cannot be enumerated from DNS, so a tool can only check selectors it already knows. If your provider uses a selector outside the default list, no key will be found even though DKIM is configured. Add the exact selector your mail provider signs with (you can read it from the d= and s= tags in an email’s DKIM-Signature header) under Custom Selectors and re-run.

What makes a DKIM key weak or insecure?

RSA keys shorter than 1024 bits are considered insecure and are easy to factor; 1024-bit keys are tolerated but should be upgraded to 2048 bits. A record with an empty p= tag is a revoked key, and a t=y flag marks the key as test mode, which tells receivers to ignore DKIM results. The Inspector flags each of these and weights them in the grade.

Does this replace SPF and DMARC?

No. DKIM is one of three core email-authentication mechanisms. SPF authorises sending hosts and DMARC ties SPF and DKIM together with a published policy. The DKIM Inspector focuses on DKIM keys; dedicated SPF and DMARC inspectors are also available on HTTPSense.

Is it free? Do I need to sign up?

Yes, the DKIM Inspector is free and requires no signup or API key.