Skip to content
ecdsa.com

Email

Find out why a DKIM signature fails, see what each forwarder recorded in an ARC chain, create the key and DNS record for your own domain, and check a brand’s BIMI record and Mark Certificate. The DKIM and ARC tools analyze messages in your browser and look up only public key names over DNS-over-HTTPS; the full SPF, DKIM, DMARC, ARC, BIMI and MTA-STS analysis runs on our server and sends the message only after you agree.

5 tools

DKIM Debugger

Why a DKIM signature fails, step by step

Paste a raw email and watch every DKIM signature being checked: simple and relaxed canonicalization with each change highlighted, body and header hashes, the key from DNS. When a signature fails, the debugger rebuilds what the signer saw and names the change that broke it.

Open tool

ARC Chain Viewer

Who forwarded an email, and what changed

Follow a forwarded email through its Authenticated Received Chain: every hop that sealed it, the authentication results it recorded, and whether each seal and message signature still verifies. See after which hop the message was changed, and whether ARC preserved the original DKIM pass.

Open tool

DKIM Record Generator

Keys and the DNS record for DKIM

Create a DKIM key pair in your browser — RSA 2048 by default, or Ed25519 — and get the DNS TXT record ready to publish: one value, the 255-byte strings DNS needs, a BIND zone line and signer configuration for OpenDKIM and rspamd. Then check that the published record matches.

Open tool

BIMI & VMC Decoder

Check a brand logo for email

Look up a domain’s BIMI record, download its Verified Mark Certificate and logo, and see what mailbox providers check: the trademark, the domains covered, the chain to a BIMI root, the logo hashes and the SVG Tiny PS rules.

Open tool

Email Authentication Analyzer

SPF, DKIM, DMARC, ARC, BIMI, MTA-STS

Paste a received email and, if you choose to send it to our server, get the verdicts a receiving mail server reaches: SPF, DKIM, DMARC with alignment, ARC, BIMI with its Mark Certificate, and the sender domain’s MTA-STS policy.

Open tool