DKIM check
marketstead.com
selector1: RSA key: 2048 bits meets the 2048-bit recommendation. Checked 27 published selector records.
DKIM keys let receivers check the digital signature on your email. We tried common selector names, but DNS cannot list every key. Find the s= label in a sent message’s DKIM-Signature header and query that exact selector.
- 1 OK
- Selectors tried
- 27
Selectors that answered
| Selector | Key |
|---|---|
| default | revoked (p= is empty) |
| revoked (p= is empty) | |
| selector1 | RSA key: 2048 bits meets the 2048-bit recommendation. |
| selector2 | RSA key: 2048 bits meets the 2048-bit recommendation. |
| s1 | revoked (p= is empty) |
| s2 | revoked (p= is empty) |
| k1 | revoked (p= is empty) |
| dkim | revoked (p= is empty) |
| revoked (p= is empty) | |
| smtp | revoked (p= is empty) |
| mandrill | revoked (p= is empty) |
| zoho | revoked (p= is empty) |
| protonmail | revoked (p= is empty) |
| protonmail._domainkey | revoked (p= is empty) |
| fm1 | revoked (p= is empty) |
| fm2 | revoked (p= is empty) |
| fm3 | revoked (p= is empty) |
| mte1 | revoked (p= is empty) |
| mte2 | revoked (p= is empty) |
| ctct1 | revoked (p= is empty) |
| ctct2 | revoked (p= is empty) |
| everlytickey1 | revoked (p= is empty) |
| everlytickey2 | revoked (p= is empty) |
| smtpout | revoked (p= is empty) |
| amazonses | revoked (p= is empty) |
| dkim1024 | revoked (p= is empty) |
| dkim2048 | revoked (p= is empty) |
Tests
-
OK
DKIM signing keys
selector1: RSA key: 2048 bits meets the 2048-bit recommendation. Checked 27 published selector records.
More info about “DKIM signing keys”
DKIM adds a digital signature to outgoing email; receivers read the public key in DNS to check it. RFC 6376 §3.6.1 permits an omitted version tag, defines an empty p= as a retired key, and t=y as testing mode. RFC 8301 §3.2 requires RSA keys of at least 1024 bits and recommends 2048 bits; the actual key size matters, not the size of its encoded text. Ed25519 uses a different, strong 32-byte key (RFC 8463 §4), so RSA size limits do not apply to it. Finding a key does not prove that outgoing mail is signed with it.
How we got this answer
Every question we asked, in order, with how long each server took to reply.
-
recursive resolver — asked <selector>._domainkey.marketstead.com TXT
Tried 27 common selector names.
Check next
Check something else
Rather not deal with this yourself?
dns.rehab is made by Marketstead. We run DNS, email and the rest of the back office for small businesses — farms, shops, studios, restaurants — and we read reports like this one for a living.
Email me this result
We send it once, with the link. No newsletter, no follow-ups.