dnstrace.dev
live sources

Signing-key validation

Inspect the public key
behind a mail signature.

Test a known selector or scan common selectors, then inspect the exact DKIM DNS record and key findings.

Try
Your connection
Detecting… Checking IPv4
Locating network Checking provider

What the result means

DKIM validation starts with the selector

DKIM selectors are chosen by the sender and cannot be reliably enumerated from DNS. The checker tests a supplied selector first, scans a limited set of common names for convenience and clearly reports which selectors were actually queried.

  • Custom selector lookup
  • Key and version checks
  • Tested-selector disclosure

Diagnostic field guide

Use the evidence, not the guess.

Three practical ways to use this lookup, followed by the boundary the result cannot cross.

Reviewed Sep 2026
01

Test a selector

Resolve the public key named in a message's DKIM-Signature header.

02

Validate key data

Check the version, key type, public-key presence and basic base64 form of the TXT record.

03

Spot a revoked key

Identify a deliberately empty p value without mistaking it for an active signing key.

How to read the result

  1. Copy the selector from the s= tag of a signed message whenever possible.
  2. Query selector._domainkey.example.com and inspect the exact TXT response.
  3. Treat common-selector scanning as a convenience only; absence does not prove DKIM is unused.

Common questions

Before you act on the result

Where do I find the DKIM selector?

Open the original message headers and locate the DKIM-Signature field. The value following s= is the selector and d= is the signing domain.

Does no result mean the domain has no DKIM?

Not necessarily. The domain may use an untested selector, rotate selectors, sign with a related domain or no longer publish an old key.

Choose the question

One system, fourteen focused tools.

Each tool has its own indexable page and opens the report at the evidence that answers its question.

DNSDNS lookup

Every address, mail, verification and policy record.

A · AAAA · MX · TXT · NS GLBGlobal DNS

Live answers from probes across ten countries.

Answer · TTL · resolver · latency RDPWHOIS / RDAP

Registrar, dates, status and published contacts.

Registry + registrar data IPIP lookup

Network owner, route, reverse name and region.

IPv4 + IPv6 ASNASN lookup

Autonomous system, BGP prefix and RPKI state.

RIPEstat routing signals TLSSSL checker

Issuer, validity, names and fingerprint.

Live certificate check MXMX lookup

Receiving servers, preference and detected mail provider.

Mail routing records MAILEmail security

Complete validation across authentication and transport.

Seven policy controls SPFSPF checker

Sender policy, authorization strength and DNS-limit risks.

Policy syntax + safety DMARCDMARC checker

Enforcement, alignment, rollout and report destinations.

Anti-spoofing policy DKIMDKIM checker

Selector lookup, key presence, type and base64 form.

Public signing keys STSMTA-STS checker

DNS marker plus live HTTPS transport policy.

Encrypted inbound mail RPTTLS-RPT checker

SMTP TLS report policy and destination validation.

Transport visibility HDRSecurity headers

Browser protections from the final HTTPS response.

HSTS · CSP · framing · policy

Evidence before certainty

The internet has layers.
We keep them separate.

A nameserver identifies the DNS operator. An edge address identifies a public delivery network. An ASN identifies the organization announcing a route. None automatically proves where a hidden origin application runs.

ObservedCorrelatedUnknown stays unknown
Read the detection methodology →

Field notes

Read the signal correctly.

All guides →
DNS · 6 minDNS propagation is really cache expiry

Why locations disagree, what TTL controls and when to test again.

 REGISTRY · 5 minWHOIS text became structured RDAP

Where registration fields come from and why some remain unpublished.

 DELIVERY · 7 minAn edge address is not an origin

What public CDN and hosting signals can and cannot prove.

Agent-ready JSON

Give your script or your AI the same public evidence.

GET /api/dns?target=example.com&type=MX
API reference →llms.txt ↗

One input, several sources

What a full lookup includes

DNSTrace.dev resolves published DNS answers, follows the primary address to its network owner, and reads registry data for the domain or IP. Your own IP is detected separately and only when this page is open.

DNSRDAPASNGeo IP

Your public network address

What is “My IP”?

Your public IP is the address websites see for your internet connection. It is assigned by your ISP, mobile carrier, workplace, VPN, or proxy and is used to route traffic back to you.

Why it is useful Diagnose your connection

Inspect your ISP, ASN, approximate network location, reverse DNS, and whether traffic is passing through a VPN or hosting network.

What it cannot reveal Not your exact location

IP location usually identifies a city or network region. It does not expose your home address or your device's GPS position.

Privacy Relay-aware, not bypassing

The primary address comes from Cloudflare. An IPv4-only check uses ipify with icanhazip as fallback. Apple Private Relay is verified against Apple's published egress ranges. The original address hidden by a relay cannot be recovered.
Copied