DKIM Archive — ZHC (dev/qa experiment)

Not prod-pinned. Archives public DKIM DNS keys (selector._domainkey.domain) for forensic re-verification after rotation. Does not store full email bodies. Competes with free prove.email on timeline + bulk + ZHC DNS health integration — not “first archive on Earth.”

API (dev/qa prefix when deployed under bucket):

GET /api/v1/dkim/history?domain=example.com — known selectors + keys
GET /api/v1/dkim/lookup?domain=&selector= — live dig + archive
GET /api/v1/dkim/fingerprint?p= — reverse lookup by key fingerprint
POST /api/v1/dkim/reverify — raw RFC822; ephemeral (body not stored)
GET /api/v1/dkim/stats — corpus size

Query form also accepts ?action=history&domain=… on the CGI.

curl -s 'https://zhc.fdh.bz/dev/api/v1/dkim/history?domain=google.com&mirror=1' | head -c 400
curl -s -X POST --data-binary @message.eml \
  'https://zhc.fdh.bz/dev/api/v1/dkim/reverify'

What we store

domain, selector, TXT value, p= fingerprint, first/last seen, source
Reserved columns for future integrity proofs (hash chain / TSA) — not active yet

Crawl: script/zhc-dkim-crawl.pl — multi-clue domain list, rate-limited, low default query cap.

DKIM selector archive