DKIM Validator
Paste a complete raw email (headers + body) and we verify its DKIM signature cryptographically — body hash, header hash and public key.
A DKIM record being published is one thing; the signatures on your actual mail being valid is another. This validator performs the same verification a receiving server does, on a real message: it canonicalizes the body and checks it against the bh= hash, reconstructs the signed header set in the exact order listed in the h= tag, fetches the public key from <selector>._domainkey.<domain>, and verifies the RSA or Ed25519 signature over the result.
To use it, you need the raw message source. In Gmail, open a message and choose "Show original"; in Outlook, "View message source"; most other clients have a similar option. Copy everything — the full header block and the body — and paste it here. Nothing is stored; the message is processed in memory to run the verification and discarded.
The two failure modes tell you different things. A body hash mismatch means the content was altered after signing — commonly a footer added by a mailing list or security gateway, or simply mangled line endings from copying. A header signature failure with a valid body hash points at a modified signed header (often Subject rewriting) or a rotated DNS key that no longer matches. If verification fails on mail sent straight from your own provider with no forwarding in between, your DKIM setup itself is broken and needs attention.
This tool verifies one concrete message. To know your signing stays healthy across providers and key rotations, the full domain check scans your published keys continuously and alerts you when a selector disappears or weakens.