What is DKIM?
DKIM (DomainKeys Identified Mail) is a signature the sending server adds to each message with a private key. The matching public key is published as a DNS TXT record at selector._domainkey.yourdomain, and receivers use it to confirm that the signed headers and body were not changed in transit. RFC 6376 defines it.
Reading the result
DNS cannot list the selectors a domain uses, so this tool probes the 21 that common providers sign with and reports each key it finds: its type, its length in bits and whether it has been revoked. Under 1024 bits is marked critical and under 2048 is a warning. A custom selector will not show up here.
Beat runs on the same engine, on a schedule, across all 41 checks and 25 blacklists. What it adds is asking again, noticing when an answer changes and telling you what to do about it.
Common DKIM key problems
No key on any common selector
Either the domain does not sign, or it signs with a custom selector. The s= tag in the DKIM-Signature header of a message you sent names the real one.
A key shorter than 2048 bits
RFC 8301 requires at least 1024 bits and recommends 2048. A 1024-bit key still verifies, and it is the weaker of the two. Rotate to 2048 when your provider allows it.
A revoked key
An empty p= tag means the key has been withdrawn on purpose. Any message still signed with that selector fails DKIM.
A key that does not parse
Long keys are often pasted with stray quotes, spaces or line breaks, or split badly by a DNS panel. A key that does not parse fails exactly like a missing one.