DKIM Record Audit

What the provider says

Quoted from x402 Bazaar · source record · read 2026-10-25

---

Facts and where they come from

Price

0.18 USDC per call Provider claim

Recorded value: 0.18 USDC per call.

Unit

per call

Protocol

x402, REST · transport: HTTP Provider claim

Auth

x402

Endpoint

https://api.zfinia.com/x402/v1/dkim-record-audit

Source

x402 Bazaar (Coinbase CDP) · Public discovery API (provider-published records)

Last checked

Not checked by us yet — the data is as the source published it

First seen

2026-10-24

Usage

1 calls · 1 unique payers in the 30 days before 2026-10-24. Measured by the x402 Bazaar, not by us and not by the provider.

Payments and earnings

No settled payment on record. Earnings for this service are unknown — not zero. The source counts 1 calls in 30 days, which at the published price is roughly $0.18 of activity. Activity is not revenue; no charge has been reconciled for it.

Payment rails

A payment rail is where the provider asks to be paid. It is not proof that anything was paid through it. See evidence levels.

Input and output, as published

Request

{
    "body": {
        "minimum_key_bits": 2048,
        "records": [
            {
                "record": "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDLiL1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghijQIDAQAB",
                "selector": "legacy2019"
            },
            {
                "record": "v=DKIM1; k=rsa; t=y; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ12345678QIDAQAB",
                "selector": "rollout2026"
            },
            {
                "record": "v=DKIM1; k=rsa; p=",
                "selector": "retired2024"
            },
            {
                "record": "v=DKIM1; k=rsa; s=tlsa; rotation=90d; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0000000000abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ12345678QIDAQAB",
                "selector": "odd"
            }
        ]
    },
    "bodyType": "json",
    "method": "POST",
    "type": "http"
}

Response

{
    "example": {
        "assumptions": [
            "The key length is derived from the length of the encoded public key, so a short key is readable from the record itself without any cryptography. The figure is rounded to the nearest common size.",
            "An empty p tag is the documented way to revoke a key, so it is reported as a revocation with its consequence rather than as a malformed record.",
            "A selector in testing mode is reported because it asks receivers to ignore failures, which means the selector cannot contribute to DMARC alignment however correctly it signs."
        ],
        "complete": true,
        "finding_count": 7,
        "findings": [
            {
                "code": "KEY_SHORTER_THAN_REQUIRED",
                "detail": "Selector legacy2019 publishes an RSA key of about 896 bits and 2048 was required. The length follows from the encoded key, so this is readable from the record without any cryptography.",
                "selector": "legacy2019"
            },
            {
                "code": "KEY_SHORTER_THAN_REQUIRED",
                "detail": "Selector rollout2026 publishes an RSA key of about 1536 bits and 2048 was required. The length follows from the encoded key, so this is readable from the record without any cryptography.",
                "selector": "rollout2026"
            },
            {
                "code": "TESTING_FLAG_SET",
                "detail": "Selector rollout2026 declares t=y, which asks receivers to treat a failure as though the message were unsigned. A selector left in testing mode cannot contribute to DMARC alignment.",
                "selector": "rollout2026"
            }
        ],
        "findings_by_code": {
            "KEY_REVOKED": 1,
            "KEY_SHORTER_THAN_REQUIRED": 3,
            "SERVICE_TYPE_EXCLUDES_EMAIL": 1,
            "TAG_NOT_RECOGNISED": 1,
            "TESTING_FLAG_SET": 1
        },
        "limitations": [
            "The records supplied. Nothing resolves DNS, no signature is verified, and whether the private key is held securely is outside this entirely. Not a security assessment.",
            "valid is true only when every selector parsed, carried a usable key and was not left in testing mode."
        ],
        "limits": {
            "maxFindings": 500,
            "maxHeaderBytes": 131072,
            "maxIncludeTree": 200,
            "maxRecordLength": 4096,
            "maxRecords": 2000,
            "spfLookupLimit": 10,
            "spfVoidLookupLimit": 2
        },
        "minimum_key_bits": 2048,
        "not_examined": [],
        "observed_at": "2026-10-02T00:00:00.000Z",
        "passed": false,
        "request_id": "example-request",
        "selector_count": 4,
        "selectors": [
            {
                "key_bits": 896,
                "key_type": "rsa",
                "revoked": false,
                "selector": "legacy2019",
                "testing": false
            },
            {
                "key_bits": 1536,
                "key_type": "rsa",
                "revoked": false,
                "selector": "rollout2026",
                "testing": true
            },
            {
                "key_bits": null,
                "key_type": "rsa",
                "revoked": true,
                "selector": "retired2024",
                "testing": false
            }
        ],
        "service_id": "dkim_record_audit",
        "service_version": "1.0.0",
        "usable_selector_count": 2,
        "valid": false
    },
    "type": "json"
}

Examples are the provider's own, not a call we made.

Provenance

One row per statement. “Verified” means we checked it ourselves and the finding is quoted. “Provider claim” means we read it in the provider's own record. “Not found” is a statement about our search, not proof of absence.

Endpoint checks

We have not called this endpoint yet. Until we do, everything above is what the source published — no more.

Tags

---