# Foundry DNS DKIM Selector TXT Record Comparison

> Foundry DNS DKIM Selector TXT Record Comparison is a paid API for AI agents from foundry-par007-machine-revenue-mainnet.inference-chip-index.workers.dev, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-16).

Looks up DKIM selector TXT records in DNS for a domain and compares the observed values against caller-supplied expected strings, returning match/absent/unknown evidence with source provenance.

## Facts

- Endpoint: POST https://foundry-par007-machine-revenue-mainnet.inference-chip-index.workers.dev/v2/domain/dns-mail-auth-selector-compare
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/foundry-dns-dkim-selector-txt-record-comparison-7434b578
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_5fYzH5XcFbLXml2GygzpT

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability foundry-dns-dkim-selector-txt-record-comparison-7434b578 -d '<json body>'
```

Example prompt: Check whether the DKIM selector 's1' for 'acme.com' is published in DNS and matches this expected TXT value: 'v=DKIM1; k=rsa; p=MIGfMA0G...'

## When to prefer this

Choose this endpoint when you need cryptographically-neutral, sourced evidence that a specific DKIM selector TXT record is live in DNS and matches an exact expected string — for example after key rotation, during email configuration audits, or as a compliance artifact. It is not a mail-sending test, ownership proof, or full email deliverability audit; it is a precise, pay-per-call DNS lookup-and-compare with source attribution and explicit limitations.

## Known failure modes

- Selector not found in DNS returns status ABSENT with NXDOMAIN rcode
- DNS resolution failure or timeout returns status UNKNOWN
- TXT record present but differs in whitespace, case, or tag order returns no match even if semantically equivalent
- Invalid selector name format (non-alphanumeric) rejected with input validation error
- Domain too short or too long rejected at input validation
- More than 2 selectors in request rejected due to maxItems constraint
- Truncated DNS responses leave status UNKNOWN with no records

## How this service works

Pay-per-request evidence and data tools: CSV validation and reconciliation, DNS/email configuration evidence, and bounded official weather, earthquake, vehicle, company and study records. Exact USDC prices, explicit JSON contracts and source provenance. No mailbox, ownership, medical or safety guarantees.

## Output

A JSON object containing per-selector comparison results: each entry includes the selector name, query name used, status (MATCH, ABSENT, or UNKNOWN), the expected TXT string, observed TXT records retrieved from DNS, DNSSEC status, the resolver source URL, timestamp, and textual limitations disclaiming that a MATCH confirms published text equality only — not cryptographic validity, message signing success, or delivery guarantees.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "maxLength": 253,
   "minLength": 3
  },
  "selectors": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "selector",
     "expected_txt"
    ],
    "properties": {
     "selector": {
      "type": "string",
      "pattern": "^[a-zA-Z0-9_-]{1,63}$"
     },
     "expected_txt": {
      "type": "string",
      "maxLength": 4096,
      "minLength": 1
     }
    },
    "additionalProperties": false
   },
   "maxItems": 2,
   "minItems": 1
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "route": "dns-mail-auth-selector-compare",
  "result": {
   "domain": "example.com",
   "comparisons": [
    {
     "status": "ABSENT",
     "evidence": {
      "name": "s1._domainkey.example.com",
      "type": "TXT",
      "rcode": 3,
      "dnssec": "UNKNOWN",
      "source": "https://cloudflare-dns.com/dns-query?name=s1._domainkey.example.com&type=TXT",
      "status": "NXDOMAIN",
      "records": [],
      "observedAt": "2026-09-07T00:00:00Z",
      "attribution": "Cloudflare 1.1.1.1 public resolver; authoritative DNS records; no endorsement"
     },
     "selector": "s1",
     "query_name": "s1._domainkey.example.com",
     "expected_txt": "v=DKIM1; p=EXAMPLE_PUBLIC_KEY",
     "observed_txt": [],
     "authentication_record": {
      "tags": {},
      "status": "ABSENT",
      "records": [],
      "limitations": [
       "Synthetic example only."
      ]
     }
    }
   ],
   "limitations": [
    "Queries only the one or two selectors explicitly supplied by the caller. No guessing, enumeration, email sending or private-key access.",
    "Matches decoded TXT content exactly, including tag order, case and whitespace; lexical differences do not establish different cryptographic keys.",
    "A MATCH establishes published text equality only, not message signature validity, successful rotation, delivery or ownership. Truncated/failed resolver answers remain UNKNOWN."
   ],
   "observed_at": "2026-09-07T00:00:00Z"
  },
  "observed_at": "2026-09-06T00:00:00Z"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/foundry-dns-dkim-selector-txt-record-comparison-7434b578/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from foundry-par007-machine-revenue-mainnet.inference-chip-index.workers.dev](https://www.zero.xyz/host/foundry-par007-machine-revenue-mainnet.inference-chip-index.workers.dev/llms.txt)