DKIM Record Lookup
Look up a domain's DKIM public keys by selector, or scan about 60 common selectors if you don't know yours. The tool decodes each key, reports its type and size, and flags revoked, weak or misconfigured records.
DKIM Record Lookup
How this lookup works. When you press Find DKIM keys, your browser sends the question over encrypted DNS-over-HTTPS to Cloudflare's public resolver (1.1.1.1), or to Google Public DNS (8.8.8.8) if you choose it below. The request goes straight from your device to them. It doesn't pass through ToolFeather: we have no server in the path, so we never see or store the names you look up. Requests are sent without cookies or a referrer. Each resolver has its own privacy policy: Cloudflare · Google.
Paste a DKIM-Signature header to fill in both
Results appear here.
Queries your browser sent (0)
These are the exact requests, each one a link. Open one to see the raw JSON answer from the resolver.
Live lookup: your browser asks Cloudflare or Google DNS directly. Nothing passes through ToolFeather.
Scratchpad auto-saved
How it works — in four simple steps
No signup and nothing to install — it all runs in your browser.
Enter the domain
The d= value from the signature.
Add the selector
Or leave it empty to scan common ones.
Find keys
Each key gets its own card with type, size and tags.
Fix weak keys
Rotate to 2048-bit RSA in your sending service.
The selector is the s= value in a DKIM-Signature header. Paste the header to fill both fields.
Features
Selector scan
Tries about 60 common selectors used by Google, Microsoft, Mailchimp, SendGrid, Mailgun, Proton, Fastmail, Zoho and others.
Real key size
Parses the public key's structure to report the exact RSA modulus size or Ed25519.
Header paste
Paste a DKIM-Signature header and the domain and selector are filled in for you.
Problem detection
Weak keys under 1024 bits, SHA-1-only records, revoked keys, testing flags and duplicates.
CNAME awareness
Shows when a selector is a CNAME to your provider's hosted key.
About the DKIM Record Lookup
DKIM (RFC 6376) signs outgoing mail with a private key. Receivers fetch the matching public key from DNS and check the signature, which proves the message really came from the domain and wasn't altered on the way. The key sits in a TXT record at selector._domainkey.domain. The selector is a name the sending service chooses, so one domain can have a separate key for each service, such as google for Google Workspace or selector1 and selector2 for Microsoft 365.
Selectors aren't listed anywhere, so the reliable way to find yours is the DKIM-Signature header of a message you sent: d= is the signing domain and s= is the selector. Paste the header and the tool fills both fields. Without a selector it tries about 60 common ones in parallel from your browser. That finds most hosted services, but it can't prove a domain has no DKIM.
For each key found, the tool decodes the base64 public key and reads the real key size from its structure. RFC 8301 requires RSA keys of at least 1024 bits, and 2048 is today's recommendation. Ed25519 keys (RFC 8463) are 256-bit and much shorter. An empty p= means the key has been revoked. The tool also catches records that allow only SHA-1, test-mode flags left on, more than one record at a selector, and CNAME-hosted keys your provider rotates for you.