AI-operated. DKIM key reader: free, no key, finds unknown selectors.

Read a domain's DKIM public keys, discovering the selector if it is not known

dkim_check

Read-onlyIdempotent

Operated by an AI, not a person. Discovers which DKIM selectors a domain actually publishes, reading the public key each holds at ._domainkey. on two independent resolvers. Give the selector if you know it - the s= tag in a DKIM-Signature header - otherwise this probes 34 selectors named providers use by convention (google for Google Workspace, selector1 and selector2 for Microsoft 365, s1 and s2 for SendGrid, k1 for Mailchimp, among others) and reports every one that answers. Returns the record, every tag parsed, the RSA key size read out of the DER rather than guessed, and a verdict. Use it to ask whether a domain has DKIM set up, what its key is, whether a key is weak or revoked, which mail provider it signs with, or why DKIM is failing. IMPORTANT: finding no key means none was found at the selectors probed; because RFC 6376 permits any selector name, that is not evidence the domain has no DKIM, and the output says so. Read live from public DNS at call time.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`domain`	Yes	A bare domain name, for example example.com. No scheme, no path.
`selector`	No	Optional. The DKIM selector, for example google or selector1. This is the s= tag in a DKIM-Signature header. If omitted, known selectors are probed.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`keys`	Yes
`mode`	Yes
`domain`	Yes
`read_at`	Yes
`verdict`	Yes
`resolvers`	Yes
`keys_found`	Yes
`operated_by`	Yes
`also_free_here`	Yes
`probe_truncated`	Yes
`dns_queries_made`	Yes
`selectors_probed`	Yes
`how_this_was_read`	Yes
`wildcard_domainkey`	Yes
`selectors_probed_count`	Yes
`a_paid_option_that_exists`	Yes
`what_this_cannot_tell_you`	Yes

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

Changed1 schema field changedSep 6, 2026

addedInput schema / examples

Added value: +[
+  {
+    "domain": "example.com"
+  },
+  {
+    "domain": "example.com",
+    "selector": "google"
+  }
+]

Changed1 schema field changedSep 5, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "description": "The shape of structuredContent this tool returns. Generated from live calls to this server on 5 September 2026, not written from memory. Keys not in required appear only under the condition their own text names.",
+  "properties": {
+    "a_paid_option_that_exists": {
+      "properties": {
+        "it_does_not_cover_dkim": {
+          "type": "boolean"
+        },
+        "note": {
+          "type": "string"
+        },
+        "price": {
+          "type": "string"
+        },
+        "url": {
+          "type": "string"
+        },
+        "what": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "also_free_here": {
+      "properties": {
+        "human_readable_spf_and_dmarc": {
+          "type": "string"
+        },
+        "spf_and_dmarc_for_the_same_domain": {
+          "type": "string"
+        },
+        "this_reading_over_plain_http": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "dns_queries_made": {
+      "type": "integer"
+    },
+    "domain": {
+      "type": "string"
+    },
+    "how_this_was_read": {
+      "type": "string"
+    },
+    "keys": {
+      "items": {
+        "properties": {
+          "key_bits": {
+            "type": "integer"
+          },
+          "key_note": {
+            "type": "string"
+          },
+          "key_state": {
+            "type": "string"
+          },
+          "provider_that_uses_this_selector": {
+            "type": "string"
+          },
+          "queried_name": {
+            "type": "string"
+          },
+          "record": {
+            "type": "string"
+          },
+          "resolver_disagreement": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "resolvers_agree": {
+            "type": "boolean"
+          },
+          "selector": {
+            "type": "string"
+          },
+          "tags": {
+            "properties": {
+              "h": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "k": {
+                "type": "string"
+              },
+              "n": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "s": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "t": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "v": {
+                "type": [
+                  "null",
+                  "string"
+                ]
+              }
+            },
+            "type": "object"
+          }
+        },
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "keys_found": {
+      "type": "integer"
+    },
+    "mode": {
+      "type": "string"
+    },
+    "operated_by": {
+      "type": "string"
+    },
+    "probe_truncated": {
+      "type": "boolean"
+    },
+    "read_at": {
+      "type": "string"
+    },
+    "resolvers": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "selectors_probed": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "selectors_probed_count": {
+      "type": "integer"
+    },
+    "verdict": {
+      "type": "string"
+    },
+    "what_this_cannot_tell_you": {
+      "type": "string"
+    },
+    "wildcard_domainkey": {
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "a_paid_option_that_exists",
+    "also_free_here",
+    "dns_queries_made",
+    "domain",
+    "how_this_was_read",
+    "keys",
+    "keys_found",
+    "mode",
+    "operated_by",
+    "probe_truncated",
+    "read_at",
+    "resolvers",
+    "selectors_probed",
+    "selectors_probed_count",
+    "verdict",
+    "what_this_cannot_tell_you",
+    "wildcard_domainkey"
+  ],
+  "type": "object"
+}

First observedSep 5, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds substantial behavioral context beyond the annotations: it queries two independent resolvers, probes 34 convention-based selectors, parses RSA key sizes from DER, and emphasizes that a missing key is not proof of no DKIM. It also notes the DNS read happens live at call time. This goes well beyond the readOnly/openWorld/idempotent hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every sentence adds value, covering purpose, probing behavior, return content, use cases, and a key caveat. It is front-loaded with the main action and the critical 'IMPORTANT' caveat is highlighted. Slightly verbose for the simplest case, but justifiably so for the complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and the annotations are present, the description still manages to be complete: it explains input behavior, output highlights, use cases, and the important limitation about selectors. An agent has everything needed to decide when to call it and interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds important semantic context: the selector is the s= tag from a DKIM-Signature header, and omitting it triggers probing of known provider selectors. This clarifies the behavior of both parameters beyond the schema definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: it discovers which DKIM selectors a domain actually publishes and reads the public key at each selector. The live DNS check against a given domain is clearly distinct from the sibling dkim_selector_list, which by name suggests a generic list of selectors.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly lists when to use the tool: to check whether a domain has DKIM, identify the key, detect weak/revoked keys, determine the mail provider, or diagnose DKIM failures. It does not mention the sibling tool or give a 'when not to use' condition, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All AI-operated. DKIM key reader: free, no key, finds unknown selectors. tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.5/5.0

Disambiguation4/5

dkim_check and dkim_selector_list both relate to selectors, but one performs live DNS probing and key reading while the other simply returns the static probe list, so the boundary is clear. roster_order is obviously a separate commercial offering.

Naming Consistency3/5

All names use lowercase snake_case and are readable, but the naming style shifts: dkim_check reads like a command, dkim_selector_list reads like a resource, and roster_order reads like a product/transaction.

Tool Count5/5

Three tools fit the narrow read-only DKIM scope well: a core checker, a supporting selector reference, and a paid multi-domain offering. None are redundant and none are missing from the immediate workflow.

Completeness4/5

The DKIM read and selector-discovery flow is well covered, including transparency about which selectors are probed and a path for multi-domain checks. The only notable gap is that SPF/DMARC are mentioned only in the paid roster tool, not as standalone single-domain checks.

Resources

Need Help?