# DKIM S3 Selector Public Key Lookup

> DKIM S3 Selector Public Key Lookup is a paid API for AI agents from dns.intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-20).

Looks up and parses the DKIM public key for the 's3' selector of a given domain by querying s3._domainkey.<domain> via Cloudflare DNS over HTTPS, returning key type, length, testing flag, and revocation status.

## Facts

- Endpoint: GET https://dns.intel.rallylive.ca/dns/dkim/s3?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-20
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dkim-s3-selector-public-key-lookup-64fb2364
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ipuhwvpIP-cJ_2PgmHZTQ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dkim-s3-selector-public-key-lookup-64fb2364
```

Example prompt: Can you look up the DKIM public key for the s3 selector on example.com and tell me if it's valid, what key type it is, and whether the key has been revoked?

## When to prefer this

Use this endpoint when you specifically need to inspect the 's3' DKIM selector for a domain — particularly useful for email security audits, deliverability troubleshooting, or verifying that a specific mail-signing configuration is active and valid. Prefer this over generic DNS TXT lookups when you need structured parsing of DKIM fields (key type, length, revocation, testing flag) rather than raw DNS text records.

## Known failure modes

- Domain has no s3._domainkey TXT record — returns NXDOMAIN or empty response
- DKIM record exists but is malformed and cannot be parsed
- Key is revoked (p= is empty) — endpoint reports this explicitly
- DNS resolution failure via Cloudflare DoH — transient network error
- Invalid or non-existent domain name provided as input

## How this service works

DKIM public key for selector "s3" of a domain: looks up s3._domainkey.<domain> (TXT, Cloudflare DoH) and parses v=, k=, key type, public-key length, testing flag and whether the key is revoked (empty p=). Confirms that mail signed with the s3 selector will verify. $0.01 per lookup.

## Output

Returns parsed DKIM TXT record details for the s3._domainkey.<domain> lookup, including the protocol version (v=), key type (k=), public key length in bits, whether the domain is in testing mode (t=y), and whether the key is revoked (empty p= field), along with a confirmation of whether mail signed with this selector will verify successfully.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dkim-s3-selector-public-key-lookup-64fb2364/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.intel.rallylive.ca](https://www.zero.xyz/host/dns.intel.rallylive.ca/llms.txt)