How to use it
- Find the selector in a message's DKIM-Signature header (the
s=tag). - Read the key:
dig +short TXT selector._domainkey.example.com. - Paste the whole record. The analyser decodes the key to report its real bit length.
- Rotate anything under 2048 bits using a new selector before revoking the old one.
Frequently asked questions
How is key length determined without DNS?
The base64 key is a SubjectPublicKeyInfo structure. The analyser walks its ASN.1 and reads the modulus length directly, so the reported bit count is exact rather than estimated.
My key shows as revoked — what happened?
An empty p= tag is an explicit revocation. That is correct after a completed rotation and an outage if the selector is still signing mail.
Should I use Ed25519?
Publish it alongside an RSA selector rather than instead of one; verifier support is still incomplete.