Free email-authentication toolkit
Follow an alias to where it actually ends up — and find out whether that target still exists. Most email providers delegate DKIM by CNAME, so this is where a provider's setup instructions usually point. No signup, no backend: everything runs right here in your browser.
Enter a hostname to follow its alias chain and check that the target resolves.
The basics, briefly
Because it lets them hold the key material instead of you. Most providers delegate DKIM by CNAME: s1._domainkey.yourdomain.com points at a name they control, so they can rotate the key without you touching DNS again. Bounce and tracking subdomains work the same way. DKIM selectors explained covers the naming, and the DKIM checker shows the key that ends up published.
It means the alias still exists but its target does not resolve — usually because the service behind it was decommissioned. It is worth fixing promptly: if the target name can be claimed again at that provider, whoever claims it inherits your subdomain, along with any trust your domain carries. This is what subdomain takeover is.
It follows the chain, reports each hop, and tells you whether the final target has an address — deciding that from the address records themselves, not from the resolver's status code, because a name that does not exist can still answer with a success status. It also checks whether MX records share the name, which RFC 1034 forbids and which is what an apex CNAME looks like in practice. It does not enumerate every other record type that could conflict, and it does not use the public suffix list to prove a name is an apex.