---
title: "Check a published DKIM key"
method: GET
path: "/api/v1/tools/dkim"
tags: ["Free DNS tools"]
---

# Check a published DKIM key

`GET /api/v1/tools/dkim`

## Request

- Base URL: `https://email-spam-tester.com` (the document declares no server; this is the origin it was published from)
- URL: `https://email-spam-tester.com/api/v1/tools/dkim`
- Auth: none declared

Fetches <selector>._domainkey.<domain>, follows a CNAME, parses the tags (RFC 6376 §3.6.1) and decodes the public key: RSA length against RFC 8301 (1024 bits minimum, 2048 recommended), Ed25519 as 32 raw bytes (RFC 8463). This checks the published key only; it verifies no signature.

Free, no key. Limited to 30 requests a minute and 300 a day per client IP across all four tools; identical queries are answered from a 60-second cache. Any completed check is 200, including "no record" and "lookup failed"; `status` and `findings` carry the verdict. Each finding has a stable `code`, a `level` and `params`; `message` is the English sentence built from them.

## Query parameters

- `domain` string, nullable: Signing domain (d=).
- `selector` string, nullable: Selector (s=), e.g. google or s1.

## Response `200`

Successful Response

- DkimOut
  - `tool` string, required
  - `query` object, required: The inputs after normalisation.
  - `checked_at` string, required: When the lookups ran, ISO 8601 UTC.
  - `duration_ms` integer, required
  - `status` 'pass' | 'warn' | 'fail' | 'error', required: Overall verdict. "error" means the check could not complete (timeout, SERVFAIL); it is never "pass" when a lookup the verdict needs failed.
  - `findings` Finding[], required
    - `code` string, required: Stable identifier, e.g. spf.too_many_lookups. The English template for every code is in /i18n/tools/findings.en.json on the website.
    - `level` 'pass' | 'info' | 'warn' | 'fail' | 'error', required
    - `params` object, required: Values the message is built from.
    - `message` string, required: The English sentence, params filled in.
  - `name` string, required
  - `cname` string, nullable, required: Where a CNAME at the name pointed.
  - `record` string, nullable, required
  - `tags` DkimTags, required
    - `v` string, nullable
    - `k` string, nullable
    - `p` string, nullable
    - `h` string, nullable
    - `s` string, nullable
    - `t` string, nullable
    - `n` string, nullable
  - `key` DkimKey, required
    - `type` 'rsa' | 'ed25519', nullable, required
    - `bits` integer, nullable, required
    - `revoked` boolean, required

## Other responses

- `422`: The input is not something we can look up (detail.code says which).
- `429`: Too many requests from this address; Retry-After says when to come back.

---

[API](https://skmtc.dev/email-spam-tester/apis/email-spam-tester-api.md) · [All operations](https://skmtc.dev/email-spam-tester/apis/email-spam-tester-api/llms.txt) · [OpenAPI document](https://skmtc.dev/email-spam-tester/apis/email-spam-tester-api/revisions/476a4c86600d?raw)