DKIM Splitter

The DKIM Splitter ingests a raw DKIM-Signature header and outputs a structured representation of its tag-value pairs. It preserves the order of tags and resolves multi-valued fields such as h (signed header list) and bh/b (body hash) for inspection. It is not a cryptographic verifier; its purpose is to expose header construction to aid audits, troubleshooting, and automated analysis in development, security operations, and incident response.

Conceptually, the tool tokenizes the header using semicolons, trims whitespace, and splits each token on the first '=' into a tag and a value. It enforces the presence of required tags v, a, d, and s, and it can present multi-valued tags as lists. The output is a structured array of tag-value pairs or a JSON object, suitable for ingestion by security dashboards, logging pipelines, or test suites.

Use cases include debugging failed DKIM verifications, auditing deployments of mail infrastructure, and preparing data for downstream verification tools. The differentiators are RFC 6376 alignment, robust handling of common formatting quirks (folded headers, extra whitespace), and deterministic outputs that preserve the original token order for traceability.

Assumptions include a single DKIM-Signature header per input; cryptographic verification, DNS key retrieval, and full mail processing are out of scope.