DKIM Record Builder & Parser
Network
DKIM is the public-key half of modern email authentication (alongside SPF and DMARC). Mail servers publish a public key as a DNS TXT record at `<selector>._domainkey.<domain>`; receivers verify the signature on incoming mail. This tool builds that record from its constituent tags (`v`, `k`, `h`, `p`, `s`, `t`, `n`, `g`) and shows the full record name, the record body, an estimated RSA key size from the public-key length, and a DNS-chunked rendition (`"..." "..."`) for records that exceed the 255-character limit of a single TXT string. The Parse mode does the reverse: paste any existing DKIM record and see each tag annotated with its purpose.
v=DKIM1; k=rsa; h=sha256; s=email; p=
- ⚠ Public key (p=) is empty — record will be invalid until you paste one.
DKIM = RFC 6376. Public key is published at `<selector>._domainkey.<domain>` as a TXT record; matching private key lives on your mail server / signer.
How to use
- Choose Build mode and enter your selector (e.g. 'mail', 'google', 's1') and domain.
- Pick key type (RSA or Ed25519) and paste the base64 public key — PEM headers (-----BEGIN ...-----) are stripped automatically.
- Optionally toggle flags (y = testing, s = strict subdomain) and set service (email / any) and notes.
- Copy the record body for your DNS provider. If it exceeds 255 chars, use the DNS-chunked version (quoted strings) — most providers accept it.
- Use Parse mode to decode any existing DKIM TXT record into labeled tags.
Frequently asked questions
- What is the selector?
- A short label you choose that lets a domain publish multiple DKIM keys at the same time — e.g. one for transactional email ('s1') and one for marketing ('mailgun'). It appears as the leftmost label of the DNS name: `selector._domainkey.example.com`. Rotate keys by publishing a new selector and switching the signer.
- Why does my record need to be split into multiple quoted strings?
- A single DNS TXT string can be at most 255 octets. Modern keys (RSA 2048 and above) produce a base64 body longer than that, so the value is split into multiple adjacent quoted strings. Resolvers concatenate them automatically. The DNS-chunked output here does that split for you.
- What's the difference between t=y and t=s?
- `t=y` (testing) tells receivers the domain is still trying DKIM out — failures are not significant. Leave it off in production. `t=s` (strict) means the `i=` identifier on signed messages must be in exactly this domain — no subdomain inheritance.
- RSA or Ed25519?
- RSA 2048 is the universally supported default; pick it unless you're sure your receivers handle Ed25519. Ed25519 produces much shorter records (a single TXT string fits) and uses smaller signatures, but support is still rolling out.
Related tools
IP Address Inspector
Type an IPv4 or IPv6 address and see its class, scope (private / public / loopback / link-local), decimal value, binary, reverse-DNS notation, and /32 CIDR.
Port Number Reference
Searchable cheat sheet for ~60 standard TCP / UDP port numbers — from 22 (SSH) and 80 (HTTP) to 6379 (Redis) and 27017 (MongoDB).
DNS Record Reference
Searchable cheat sheet for DNS record types — A, AAAA, CNAME, MX, TXT, NS, SOA, PTR, SRV, CAA, DNSSEC, SVCB / HTTPS — with examples.
Subnet Calculator (IPv4 / CIDR)
Parse an IPv4 CIDR into network address, broadcast, netmask, wildcard, host range, and class. Shows binary breakdown and private/public status.
User Agent Parser
Parse a User-Agent string into browser, engine, OS, device, and CPU. Detects 20+ bots including GPTBot, ClaudeBot, PerplexityBot.
HTTP Status Code Reference
Searchable list of every HTTP status code (1xx-5xx) with summary, RFC, when to use, and common pitfalls.