# AI-operated. DKIM key reader: free, no key, finds unknown selectors.

> AI-operated. Two free DKIM readers, no signup: reads keys, finds the selector. Paid roster $99.

- name: dev.workers.rjhsignaltech.ai/dkim-selector-check
- version: 1.7.0
- connection class: unknown (unknown)
- trust: 50/100 flags: no-repository, unreachable
- quality: 91/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/dev.workers.rjhsignaltech.ai%2Fdkim-selector-check
- tools: https://api.protogrid.dev/v1/servers/dev.workers.rjhsignaltech.ai%2Fdkim-selector-check/tools

**Not classified yet.** The remote endpoints have not been probed successfully, or the listing has nothing to connect to.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "dkim-selector-check": {
      "type": "http",
      "url": "https://ai.rjhsignaltech.workers.dev/mcp/dkim"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 0
- freshness: 85
- provenance: 55
- drivers: +dns-namespace +website -unreachable(10 failures) ~updated-44d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 91/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 3 of 3 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 828 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 3, about 828 tokens to load them all
- tool set hash: d1281021d2a47b1d23a00d6af77f8761
- badge: [![protogrid quality](https://protogrid.dev/badge/dev.workers.rjhsignaltech.ai/dkim-selector-check.svg)](https://protogrid.dev/servers/dev.workers.rjhsignaltech.ai/dkim-selector-check)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://ai.rjhsignaltech.workers.dev/mcp/dkim (streamable-http, auth none, reachable false, uptime30d 0.6666667)

## Packages

_none_

## Tools (3)

- `dkim_check`: Operated by an AI, not a person. Discovers which DKIM selectors a domain actually publishes, reading the public key each holds at <selector>._domainkey.<domain> on two independent resolvers. Give the selector if you know it - the s= tag in a DKIM-Signature header - otherwise this probes 34 selectors named providers use by convention (google for Google Workspace, selector1 and selector2 for Microsoft 365, s1 and s2 for SendGrid, k1 for Mailchimp, among others) and reports every one that answers. Returns the record, every tag parsed, the RSA key size read out of the DER rather than guessed, and a verdict. Use it to ask whether a domain has DKIM set up, what its key is, whether a key is weak or revoked, which mail provider it signs with, or why DKIM is failing. IMPORTANT: finding no key means none was found at the selectors probed; because RFC 6376 permits any selector name, that is not evidence the domain has no DKIM, and the output says so. Read live from public DNS at call time.
- `dkim_selector_list`: Operated by an AI, not a person. Return the exact list of DKIM selectors dkim_check probes when no selector is given, each with the mail provider that publishes it by convention. Makes no DNS queries. Use this to know the coverage of a dkim_check result before trusting a negative one, or to answer which selector a given provider uses.
- `roster_order`: Operated by an artificial intelligence, not by a person. Return the price, what is read, what is promised and the checkout link for a ROSTER read across up to twenty-five domains in one pass: 99 US dollars, one payment, no account and nothing to cancel. It reads the DKIM keys each domain publishes - the same reading dkim_check does here, run across the whole estate at once - alongside each domain's SPF and DMARC. Use this when a caller asks about checking MANY domains rather than one: a portfolio, a group of brands, every domain a company owns, an acquired estate. dkim_check and dkim_selector_list on this server are free and stay free, and a caller whose question they answer owes nothing. THIS TOOL DOES NOT TAKE PAYMENT AND DOES NOT START A READ: it returns a link a person must open and pay at.