DKIM key length checker: is your key 1024 or 2048 bits?
In short: Paste the TXT value of a DKIM key record, quoted or not, split or whole. The tool decodes the public key in your browser, reads the RSA modulus size and lists the record's tags. Limit: It reads the key you paste; it does not check that the record is published or that mail is signed with it.
Paste the DKIM TXT record and the tool decodes the p tag, reads the RSA modulus and reports the key size in bits. RFC 8301 says signers must use at least 1024 bits and should use at least 2048, and verifiers must not accept signatures from RSA keys under 1024. The tool also reads the other tags.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
Sample result
The pasted DKIM record holds a 2048-bit RSA key, which meets the RFC 8301 recommendation.
- Key size
- 2048 bits
- Minimum
- 1024 bits
- Recommended
- 2048 bits
What this means for you
A key under 1024 bits would not be treated as valid by verifiers.
- Reads the RSA modulus
- Lists every tag
- Spots revoked keys
- Works before you publish
- DKIM
- RFC 8301
- Key size
By SimpleVerifier Team · Last updated · Runs in your browser; nothing you paste is sent to us
A strong key protects the signature, not the list.
- Once the DKIM record is right, clean the list you are about to send to.
- Upload or paste it at /verify. Every address gets a live mailbox check, and the first 100 email checks are free with a Google sign-in, no card.
How do I check the size of a DKIM key?
- Copy the TXT value of the DKIM record, from your DNS panel or from a lookup of selector._domainkey.yourdomain.
- Paste it in. Quotes and split strings are fine.
- Read the key size in bits and what it means against the 1024-bit minimum and 2048-bit recommendation.
- If the key is short, create a new key at your sending service, publish it under a new selector and switch signing to it.
Example
- You enter
- The same DKIM record with a 2048-bit RSA key:
v=DKIM1; k=rsa; p=.... - You get
- Key size 2048 bits, RSA, which meets the 2048-bit recommendation in RFC 8301. The record is 410 characters, over one 255-octet string, so it is published as two strings.
- Limits
- Runs in your browser; nothing is uploaded.
What does a DKIM key record contain?
RFC 6376 defines the tags: v for the version (DKIM1), h for hash algorithms, k for the key type (rsa unless stated), n for notes, p for the base64 public key, s for the service type and t for flags such as y for testing. An empty p tag means the key has been revoked. The tool lists the tags it finds and reads the key in p.
How long should a DKIM key be?
RFC 8301 says signers must use RSA keys of at least 1024 bits and should use keys of at least 2048 bits, and that verifiers must not treat signatures from RSA keys shorter than 1024 bits as valid. The tool labels the key against those two numbers and states nothing else about it.
Why does a 2048-bit key need a split TXT value?
A 2048-bit public key written in base64 is longer than the 255 octets one DNS string holds, so the record is published as two or more strings that readers join. The TXT record splitter cuts a value for you and the checker reads a record whether or not it is split.
Who uses this tool, and for what?
- Cold email senders
- Confirm the key on a new sending domain before the first warm-up send.
- Deliverability consultants
- Audit client records for old short keys.
- Sales ops
- Read the record a provider sent over before it is published.
What can’t this tool tell you?
- It reads the key you paste; it does not check that the record is published or that mail is signed with it.
- Only RSA keys are measured.
- Key size is one part of DKIM; alignment and selector setup are separate checks.
- Standards can be updated; the tool follows RFC 6376 and RFC 8301 as written.
Common questions
- What size DKIM key should I use?
- RFC 8301 says at least 2048 bits for signers where possible and never under 1024. Check what your sending service offers when you create the key.
- Does the tool look the record up in DNS?
- No. It reads what you paste, so it works for a record you have not published yet.
- What if the p tag is empty?
- That means the key was revoked, and mail signed with it will not pass. The tool says so.
- Does it read Ed25519 keys?
- It lists their tags but measures RSA keys only.
- Why is my key size not exactly 1024 or 2048?
- The tool counts the bits of the modulus itself, so a key made for 2048 bits normally reads 2048, and one a bit short in the top byte reads a little less.
- Is my record sent anywhere?
- No. A public key is decoded in your browser.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.