How to verify a DKIM signature?

Paste the raw message or upload its .eml file above. The validator recomputes the body hash, rebuilds the signed headers and checks the signature against the public key at the selector and domain in the DKIM-Signature header.

Do DKIM signatures expire?

Only if the signer sets an x= tag, which gives an expiry time. Without x= a signature doesn't expire, but it stops verifying once the signer removes or rotates the public key.

The body or a signed header changed in transit, the public key is missing, revoked or rotated, the key record is malformed, or the algorithm is rsa-sha1, which receivers no longer accept.

How to check a DKIM signature in Outlook?

Outlook's message properties show the headers but not the body, and headers alone can't verify the body hash. Save the message as an .eml file where your Outlook offers it and upload that here; classic Outlook's .msg format can't be read.

Is DKIM a digital signature?

Yes. The sending server signs a hash of selected headers and the body with a private key, and receivers verify it with the public key published in DNS.

DKIM signature validator: paste a raw email

A DKIM signature validator checks a received email the way the receiving server did. Paste the raw message or upload the .eml file: this tool recomputes the body hash, rebuilds the signed headers, fetches the public key from s= and d=, and verifies the signature. When DKIM fails, it says whether the body or the headers changed.

Raw email (headers and body)

Upload an .eml file (most exact)The message stays in your browser; only d= and s= are sent, to fetch the public key.

SimpleAPI

Sample result

The DKIM signature from acme.example checks out against its published key.

Signature: d=acme.example
Body hash: Matches bh=
Selector: google

What this means for you

The message wasn't changed after signing, and the signature matches the From domain.

Next step:Check a domain's DKIM key

Paste a raw message or upload an .eml file
Recomputes the body hash per RFC 6376
rsa-sha256 and ed25519-sha256 signatures
Explains why a signature failed

DKIM
Headers
RFC 6376

By SimpleVerifier Team · Last updated October 17, 2026

How do I check a received email's DKIM signature?

Get the raw message. In Gmail, open the email, choose Show original, then Download original. In other clients, save or export the message as an .eml file.
Upload the .eml file (most exact), or paste the whole message, headers and body, into the box.
Press Validate DKIM signature. The body hash is computed in your browser; only the domain and selector go to our server, to fetch the public key.
Read each signature's result: body hash, signature, alignment with the From domain, and any warnings such as l= or an expired x=.

Example

You enter: The .eml file of a message signed with d=acme.example and s=google.
You get: Verified: the recomputed body hash matches bh=, the rsa-sha256 signature checks out against the key published at google._domainkey.acme.example, and the signing domain aligns with the From address.
Limits: The message is read in your browser; only the domain and selector are sent, to fetch the public key, 10 key lookups a minute per connection.

How do I verify a DKIM signature?

Verify it from the raw message, following RFC 6376. Take the DKIM-Signature header, canonicalize the body as its c= tag says (simple or relaxed), hash it and compare with bh=. Then canonicalize the headers listed in h=, add the signature header itself with b= emptied, and check b= against the public key published at s=._domainkey.d=. This tool does all of that, with WebCrypto in your browser.

You need the original bytes. Gmail's Show original page and its Download original button give you exactly what arrived (Google's guide to full headers). Copying the text out of a mail client usually changes spaces and line breaks, which can break the body hash even though the message was fine on arrival, so upload the file where you can.

What does "DKIM signature body hash not verified" mean?

It means the body that arrived isn't the body that was signed: the hash computed from it doesn't match the signature's bh= value. Common causes are a mailing list adding a footer, a security gateway rewriting links or adding a banner, a forward that re-encodes the message, or, when you test by pasting, the copy itself. A signature with relaxed body canonicalization (c=…/relaxed) tolerates changes in whitespace but not in content.

When the body hash verifies but the signature doesn't, a signed header changed instead: often the Subject, gaining a tag like [External], or the From header, rewritten by a list. A signature can also fail because the key was rotated after the message was sent, so a months-old message may fail today even if it passed on arrival.

What does a DKIM signature look like?

A header like DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=google; h=from:to:subject:date; bh=…; b=…. d= is the signing domain, s= the selector, h= the signed headers, bh= the body hash and b= the signature. a= is the algorithm: rsa-sha256 is standard, ed25519-sha256 is the newer option from RFC 8463, and rsa-sha1 is obsolete: RFC 8301 says verifiers must not accept it.

A message can carry several signatures, one from each system that signed it: your domain, your sending platform, a mailing list. Each is checked on its own, and only one needs to pass and align with the From domain for DMARC.

Why is my DKIM signature not aligned?

Because d= isn't your From domain. Many platforms sign with their own domain by default (d=sendgrid.net, d=mcsv.net), so DKIM passes but doesn't count for your DMARC. The fix is in the platform: set up DKIM for your own domain there, which publishes a key under your domain and signs with d=yourdomain.com. This tool shows whether each signature aligns; to check that the key is published, use the DKIM checker.

How is this different from a DKIM record checker?

	Signature validator	DKIM record checker
Input	A received email	A domain (and selector)
Checks the body hash	Yes	No
Verifies the signature	Yes	No
Checks the published key	Fetches it to verify	Yes, with key length and flags
Finds selectors	Reads s= from the message	Tries common selectors

Who uses this tool, and for what?

Email admins: Find out whether a security gateway or list software is breaking signatures, by checking the same message before and after it passes through.
Cold emailers: Confirm a test message from a new sending domain is signed with your own d= and verifies, before the first campaign.
Developers: Debug your own DKIM signing code against a reference check, including relaxed and simple canonicalization and l=.
Agencies: Show a client exactly which signature fails and why, instead of a bare dkim=fail in a header.

What can’t this tool tell you?

It verifies against the key published today. If the selector was rotated since the message was sent, an honest signature can fail now.
Pasted text often loses exact spacing and line breaks; for a definite answer on the body hash, upload the original .eml.
It checks DKIM only. ARC, SPF and DMARC results are in the Authentication-Results header, which the tool shows but doesn't recompute.
Ed25519 needs a current browser with WebCrypto Ed25519 support; older browsers report that they can't check it.
A valid signature proves the domain signed the message; it says nothing about whether the recipient addresses exist.

Common questions

How to verify a DKIM signature?: Paste the raw message or upload its .eml file above. The validator recomputes the body hash, rebuilds the signed headers and checks the signature against the public key at the selector and domain in the DKIM-Signature header.
What does DKIM signature body hash not verified mean?: The message body changed after it was signed, so its hash no longer matches bh=. A list footer, a gateway rewriting links, a forward or copy and paste are the usual causes.
Do DKIM signatures expire?: Only if the signer sets an x= tag, which gives an expiry time. Without x= a signature doesn't expire, but it stops verifying once the signer removes or rotates the public key.
Why does DKIM fail?: The body or a signed header changed in transit, the public key is missing, revoked or rotated, the key record is malformed, or the algorithm is rsa-sha1, which receivers no longer accept.
What does a DKIM signature look like?: A DKIM-Signature header with tags: v=1, a= (algorithm), c= (canonicalization), d= (domain), s= (selector), h= (signed headers), bh= (body hash) and b= (the signature itself).
How to check a DKIM signature in Outlook?: Outlook's message properties show the headers but not the body, and headers alone can't verify the body hash. Save the message as an .eml file where your Outlook offers it and upload that here; classic Outlook's .msg format can't be read.
Is DKIM a digital signature?: Yes. The sending server signs a hash of selected headers and the body with a private key, and receivers verify it with the public key published in DNS.

Sources

You audited one domain. Cold outreach means thousands.

This tool checks a domain you type in. It will not tell you which addresses at that domain are real.

Bulk mailbox verification with real SMTP checks
The email finder — name plus company to a verified address
Website enrichment for emails, owner names and socials

Get started — $29.99/mo See the published limits first

One plan, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.