# DKIM Record Audit

> DKIM Record Audit is a paid API for AI agents from api.zfinia.com, paid per call via x402, $0.18/call, status unknown (last checked 2026-10-10).

Audits DKIM selector records for weak key length, testing mode, revoked keys, and unsupported key types

## Facts

- Endpoint: POST https://api.zfinia.com/x402/v1/dkim-record-audit?utm_source=zero.xyz
- Price: $0.18/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dkim-record-audit-98b5a53c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ErVovI8CD3RaEggrME2OK

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dkim-record-audit-98b5a53c -d '<json body>'
```

Example prompt: Can you audit these DKIM selector records for me and flag any that have keys shorter than 2048 bits, are stuck in testing mode, or have been revoked? Here are the selector names and their raw TXT record values.

## When to prefer this

Use this endpoint when you need to programmatically audit one or more DKIM selector records for security and compliance issues — specifically weak key lengths, testing-mode selectors that silently undermine DMARC, revoked keys, and unsupported key types. Prefer this over manual inspection or generic DNS tools when you need structured, machine-readable findings at scale (up to 100 records per call) with a configurable minimum key strength threshold.

## Known failure modes

- Malformed DKIM record string that cannot be parsed returns a parse error for that record
- Record array is empty or exceeds 100 items — rejected by schema validation
- minimum_key_bits outside the 512–8192 range causes a validation error
- Non-DKIM TXT records submitted may produce incomplete or misleading audit output
- Payment not completed (x402) results in 402 response before any audit is performed

## How this service works

Audit DKIM selector records. The key length follows from the length of the encoded public key, so a short RSA key is readable from the record itself with no cryptography. Reports a key shorter than a stated minimum; a selector left in testing mode, which asks receivers to treat a failure as unsigned so it cannot contribute to DMARC alignment however correctly it signs; a revoked key, with its consequence; and a key type verifiers do not implement.

## Output

A structured audit report for each submitted selector/record pair, indicating: whether the RSA key length falls below the specified minimum, whether the selector is in testing mode (p=test) which prevents DMARC alignment, whether the key has been revoked and the consequence of that revocation, and whether the key type is one that email verifiers do not implement.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "records": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "selector",
     "record"
    ],
    "properties": {
     "record": {
      "type": "string",
      "maxLength": 4096
     },
     "selector": {
      "type": "string",
      "maxLength": 128
     }
    },
    "additionalProperties": false
   },
   "maxItems": 100,
   "minItems": 1
  },
  "minimum_key_bits": {
   "type": "integer",
   "maximum": 8192,
   "minimum": 512
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dkim-record-audit-98b5a53c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.zfinia.com](https://www.zero.xyz/host/api.zfinia.com/llms.txt)