# Free DKIM Record Validator & Key Checker

> Free online DKIM record validator and key checker. Test selector DNS records, verify RSA 1024/2048-bit keys, and check syntax and CNAME delegation instantly.

DKIM signs your messages so a receiver can prove they were not altered and came from someone holding your private key. The public key lives in DNS at a selector you choose. Most providers now hand you a CNAME so they can rotate keys without asking you to touch DNS again.

## Checks Performed
- The selector resolves and returns a key
- The record parses and the key type is supported
- Key length meets the 1024-bit minimum, 2048 preferred
- The record is not proxied — Cloudflare's orange cloud breaks DKIM

## Sample Verification (sada._domainkey.example.com)
Valid 2048-bit key, resolving cleanly through a CNAME.

| Check | Verdict | Details |
| --- | --- | --- |
| Selector resolves | PASS | CNAME → sada.dkim.sadasend.net |
| Key type | PASS | rsa |
| Key length | PASS | 2048 bits |
| Proxy status | PASS | DNS only |

## Frequently Asked Questions
### What is a DKIM selector?

A selector is a label that lets one domain publish several DKIM keys at once, each at its own DNS location: <selector>._domainkey.<domain>. Providers use different selectors so their keys do not collide with yours or each other's.

### Why does Cloudflare break DKIM?

Cloudflare's proxy (the orange cloud) intercepts the record and returns its own response, so the receiving server cannot fetch your public key. Set DKIM records to DNS only.

### Should I use a CNAME or a TXT record?

Take the CNAME if your provider offers one. It lets them rotate the underlying key — after a compromise, or on a routine schedule — without you editing DNS again.