Network Tools
Email authentication diagnostic
Inspect a selector’s published TXT record, key material, restrictions, aliases, and authoritative DNS evidence—or validate a record locally before publishing it.
Use the signing domain from the DKIM-Signature d= tag and its selector from s=. The checker adds ._domainkey. for you.
Paste one logical DKIM TXT value. Quoted DNS chunks are accepted and joined in order. This mode makes no network request.
Analysis result
Errors and operational warnings are shown first. A passing record can still fail a real message if its private key, signature, headers, or body do not match.
Logical TXT values are analyzed separately; multiple DNS records are never silently joined together.
These are observations returned by Octetify’s same-origin analyzer. DNSSEC is reported as the analyzer’s assessment, not inferred in this page.
Send a message through the service you are testing, open its full source, and locate DKIM-Signature. Use its d= value as the domain and s= value as the selector.
DNS has no general “list every selector” query. Guessing common names can miss randomized, dated, regional, or delegated selectors, so this tool does not present guesses as discovery.
Create a new key under a new selector, publish it, allow DNS caches to refresh, then move signers to that selector. Keep the old public key available while previously signed mail can still be verified.
Remove or revoke the old selector after the overlap. Do not reuse an old selector for unrelated key material; receivers cannot distinguish a delayed message from a forgery after reuse.
A pass here means the public record is retrievable and structurally usable under the checks shown. It does not test a private key or a message signature.
For a delivery failure, also inspect the full Authentication-Results and DKIM-Signature headers, the signing algorithm, canonicalization, body hash, timestamp, and DMARC alignment.