DKIM check
marketstead.com · selector default
default: revoked (p= is empty)
DKIM keys let receivers check the digital signature on your email. The selector is the s= label in a sent message’s DKIM-Signature header. A published key alone does not prove that outgoing messages use it.
- 1 note
- Record
- v=DKIM1; p=
The DKIM key at default._domainkey.marketstead.com
| Tag | Value | What it means |
|---|---|---|
| v | DKIM1 | Version — DKIM1 (optional, but must be first if present). |
| p | The public key itself. Empty means the key has been revoked. |
Tests
-
Info
DKIM signing keys
default: revoked (p= is empty)
More info about “DKIM signing keys”
DKIM adds a digital signature to outgoing email; receivers read the public key in DNS to check it. RFC 6376 §3.6.1 permits an omitted version tag, defines an empty p= as a retired key, and t=y as testing mode. RFC 8301 §3.2 requires RSA keys of at least 1024 bits and recommends 2048 bits; the actual key size matters, not the size of its encoded text. Ed25519 uses a different, strong 32-byte key (RFC 8463 §4), so RSA size limits do not apply to it. Finding a key does not prove that outgoing mail is signed with it.
How we got this answer
Every question we asked, in order, with how long each server took to reply.
-
recursive resolver — asked default._domainkey.marketstead.com SOA
· 24 ms
The zone holding default._domainkey.marketstead.com is marketstead.com. -
todd.ns.cloudflare.com (108.162.193.146) — asked default._domainkey.marketstead.com TXT
· 15 ms
1 TXT record returned (authoritative).
Check next
Check something else
Rather not deal with this yourself?
dns.rehab is made by Marketstead. We run DNS, email and the rest of the back office for small businesses — farms, shops, studios, restaurants — and we read reports like this one for a living.
Email me this result
We send it once, with the link. No newsletter, no follow-ups.