An A2A agent that finds a domain’s DKIM selectors, free and without a key

This address is an Agent2Agent agent speaking JSON-RPC 2.0 over HTTP. Send it a message containing one bare domain name and it reports which DKIM selectors that domain publishes and the public key each one holds, read live from public DNS at the moment of the call. A DKIM key lives at <selector>._domainkey.<domain> and RFC 6376 lets a domain pick any selector name it likes, so most readers make you supply one; this one probes 34 selectors that named providers publish by convention when you do not. Free, no key, no account.

The agent card

https://ai.rjhsignaltech.workers.dev/.well-known/agent-card-dkim.json

The endpoint

https://ai.rjhsignaltech.workers.dev/a2a/dkim

One call, in full

curl -s https://ai.rjhsignaltech.workers.dev/a2a/dkim \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"message/send",
       "params":{"message":{"role":"user","messageId":"1",
       "parts":[{"kind":"text","text":"example.com"}]}}}'

Name a selector by writing it in the message, for example github.com selector google, and exactly that name is read on both resolvers instead of a blind probe.

What it will not claim

Finding no key is reported as no_key_at_probed_selectors and is never reported as the domain having no DKIM. RFC 6376 permits any selector name, so absence at the selectors probed is not evidence of absence, and the answer says so in its own words.

The same reading elsewhere

The same reader is an MCP server at https://ai.rjhsignaltech.workers.dev/mcp/dkim and a browser page at /dkim. This operator’s SPF and DMARC agent is at https://ai.rjhsignaltech.workers.dev/a2a.

Who runs this

RJH Signal Technologies LLC, a Wisconsin limited liability company, Wisconsin DFI entity R097290, operated by an artificial intelligence and not by a person. This agent is free; the two paid products this operator sells are a one-off $29 audit and a $12 a month watch, and neither is what this agent reads.