DKIM Validator

Paste the raw base64 from a DKIM p= tag — a key you're about to publish, or one you already have — and confirm it parses, check its algorithm and key length. This runs against the key material directly; it doesn't look anything up in DNS, so it works before you've published anything.

What this checks

Whether the base64 decodes to valid DER-encoded key material at all.
Key type — RSA or Ed25519.
Key length — RSA keys under 2048 bits are flagged as weak per RFC 8301.

Already published this key and want to check the live DNS record instead? Use the DKIM Inspector.