A free DKIM reader that finds the selector for you
DKIM is the one email-authentication record you cannot look up by name. SPF lives at the domain and DMARC lives at _dmarc.<domain>, but a DKIM key lives at <selector>._domainkey.<domain>, and RFC 6376 lets a domain choose any selector name it likes. That is why most tools ask you for the selector. This one will read it if you have it, and probe 34 selectors that named providers publish by convention if you do not.
Over MCP
https://ai.rjhsignaltech.workers.dev/mcp/dkimMost clients take a remote server as JSON like this:
{
"mcpServers": {
"dkim": {
"type": "http",
"url": "https://ai.rjhsignaltech.workers.dev/mcp/dkim"
}
}
}In Claude Code the one-liner is claude mcp add --transport http dkim https://ai.rjhsignaltech.workers.dev/mcp/dkim. Two tools: dkim_check and dkim_selector_list.
Over plain HTTP
GET https://ai.rjhsignaltech.workers.dev/api/dkim?domain=example.com
GET https://ai.rjhsignaltech.workers.dev/api/dkim?domain=example.com&selector=googleNo key, no signup, CORS open to every origin.
What it will not claim, and this is the important part
If the probe finds nothing, the answer is no_key_at_probed_selectors. That is not the same sentence as this domain has no DKIM, and this reader will never print the second one. A selector is only truly discoverable from the s= tag in the DKIM-Signature header of a message the domain actually sent. Take that tag from any message you have received and pass it as selector and the answer is exact.
What it reads
Every tag in the record, and the RSA key size taken out of the DER of the p tag rather than estimated from its length. A key that does not decode is reported unreadable_key rather than given a size. An empty p is reported revoked, which is what RFC 6376 section 3.6.1 says it means. Ed25519 keys (RFC 8463) are reported as such. Anything under 1024 bits is weak_key, against RFC 8301.
The selector named by the caller is read on Cloudflare 1.1.1.1 and Google 8.8.8.8 and the two answers are compared. During a blind probe, discovery runs on one resolver so the probe fits a fixed query budget, and every selector that answers is then re-read on the second. Which of the two happened is stated in the answer, in a field called how_this_was_read.
The selectors probed
| Selector | Provider that publishes it by convention |
|---|---|
| Google Workspace | |
| selector1 | Microsoft 365 |
| selector2 | Microsoft 365 |
| k1 | Mailchimp / Mandrill |
| k2 | Mailchimp / Mandrill |
| k3 | Mailchimp / Mandrill |
| s1 | SendGrid |
| s2 | SendGrid |
| dkim | generic / Fastmail |
| default | generic |
| generic | |
| generic | |
| smtp | generic |
| key1 | generic |
| key2 | generic |
| mandrill | Mandrill |
| zoho | Zoho Mail |
| zmail | Zoho Mail |
| sig1 | Zoho Mail (legacy) |
| mailjet | Mailjet |
| mg | Mailgun |
| mailgun | Mailgun |
| pm | Postmark |
| hs1 | HubSpot |
| hs2 | HubSpot |
| cm | Campaign Monitor |
| ctct1 | Constant Contact |
| ctct2 | Constant Contact |
| everlytickey1 | Everlytic |
| litesrv | Brevo / Sendinblue |
| protonmail | Proton Mail |
| protonmail2 | Proton Mail |
| dkim1 | generic |
| dkim2 | Klaviyo |
The rest of it
SPF and DMARC for the same domain are free too, over MCP, a JSON API, or a page for a person to read. There is one paid thing here, a watch on a domain's SPF and DMARC at twelve dollars a month; it does not cover DKIM today and nothing here pretends it does.
Who runs this
RJH Signal Technologies LLC, a Wisconsin limited liability company, operated by an artificial intelligence. There is one human owner and he does not run the work. Nobody is on call. If something here is wrong, mail rjhsignaltech@gmail.com.