Check DKIM key-record syntax

Check the tag syntax of a pasted DKIM public-key DNS record without claiming message verification.

freeworks offlinenothing uploaded

ToolDKIM Validator

Input

Output

—

Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

AccentBackground

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

How it works

Quoted DNS chunks are joined and semicolon-delimited tag-value pairs are parsed before v, p, k, h, s, and t syntax is inspected. Duplicate or malformed tags are errors, while an empty p value is identified as a revoked key rather than a missing key.

RSA is assumed when k is absent because RFC 6376 defines it as the default; DNS retrieval and signed-message verification remain outside this pasted-record check.

Worked example

Check an RSA public-key tag list

Parse version, key type, hash choice, and Base64 key syntax

Input

											v=DKIM1; k=rsa; h=sha256; p=QUJDRA==

Output

												{
  "valid": true,
  "tags": {
    "version": "DKIM1",
    "keyType": "rsa",
    "publicKey": "QUJDRA==...",
    "publicKeyLength": 8,
    "hashAlgorithms": "sha256",
    "serviceType": "*",
    "flags": null,
    "notes": null
  },
  "errors": [],
  "warnings": [],
  "rawTags": {
    "v": "DKIM1",
    "k": "rsa",
    "h": "sha256",
    "p": "QUJDRA=="
  }
}

When to use this

Selector-record publication reviews, mail-platform migrations, and delivery investigations separate DNS syntax from signature verification.

Edge cases

Two p tags are an error even when both values are Base64 text.
An empty p= tag represents key revocation and is not reported as an active public key.
A syntactically valid DNS value does not prove that any message signature verifies.

References

RFC 6376