dns.rehab by Marketstead

DKIM check

marketstead.com · selector selector1

selector1: RSA key: 2048 bits meets the 2048-bit recommendation.

DKIM keys let receivers check the digital signature on your email. The selector is the s= label in a sent message’s DKIM-Signature header. A published key alone does not prove that outgoing messages use it.

  • 1 OK

Checked Took 0.4 s

Record
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlZ1D/rs0R3Gn6JEBNeVAK2YJL6yaS6clevvQ9OaNdYql/y0QZQIQpno2ELYw7EXAtvKez6/i+CHULW…

The DKIM key at selector1._domainkey.marketstead.com

The DKIM key at selector1._domainkey.marketstead.com
Tag Value What it means
v DKIM1 Version — DKIM1 (optional, but must be first if present).
k rsa Key type: rsa (default) or ed25519.
p MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlZ1D… The public key itself. Empty means the key has been revoked.

Tests

  1. OK

    DKIM signing keys

    selector1: RSA key: 2048 bits meets the 2048-bit recommendation.

    More info about “DKIM signing keys”

    DKIM adds a digital signature to outgoing email; receivers read the public key in DNS to check it. RFC 6376 §3.6.1 permits an omitted version tag, defines an empty p= as a retired key, and t=y as testing mode. RFC 8301 §3.2 requires RSA keys of at least 1024 bits and recommends 2048 bits; the actual key size matters, not the size of its encoded text. Ed25519 uses a different, strong 32-byte key (RFC 8463 §4), so RSA size limits do not apply to it. Finding a key does not prove that outgoing mail is signed with it.

How we got this answer

Every question we asked, in order, with how long each server took to reply.

  1. recursive resolver — asked selector1._domainkey.marketstead.com SOA · 113 ms
    The zone holding selector1._domainkey.marketstead.com is w-v1.dkim.mail.microsoft.
  2. ns1-80.azure-dns.com (150.171.10.80) — asked selector1._domainkey.marketstead.com TXT · 25 ms
    Answered, but not authoritatively — trying the next server.
  3. ns2-80.azure-dns.net (150.171.16.80) — asked selector1._domainkey.marketstead.com TXT · 24 ms
    Answered, but not authoritatively — trying the next server.
  4. recursive resolver — asked selector1._domainkey.marketstead.com TXT · 45 ms
    1 TXT record returned. (via a recursive resolver; may be cached)

Check something else

Type a domain for the full DNS check, or a command like mx:example.com, dkim:example.com:google or blacklist:203.0.113.7.

Rather not deal with this yourself?

dns.rehab is made by Marketstead. We run DNS, email and the rest of the back office for small businesses — farms, shops, studios, restaurants — and we read reports like this one for a living.

Get help with marketstead.com →

Email me this result

We send it once, with the link. No newsletter, no follow-ups.