Your provider issues the keypair and signs your mail, exactly as it does now. We probe the selectors the common providers sign with, show which resolve on your domain, grade the key strength, and flag the faults that make a signature decorative.
The scan needs no account. Plans start at 12 €/mo with a 14-day trial (card required, one per account).
2 of 4 selectors sign without protecting anything: one key too short to mean much, one publishing t=y, which tells receivers to ignore its failures.
DKIM fails quietly in two ways that no inbox will ever show you, and both are common enough that most domains have one.
Third-party services sign with their own selectors. We probe the ones the providers we support use, so a sender nobody remembers adding shows up as a selector on your domain.
1024-bit RSA is still widespread and no longer meaningful protection. RSA keys are graded against the 2048-bit minimum; an Ed25519 key is reported as the fixed-strength key it is.
A record publishing t=y tells receivers to ignore signature failures. The signature is present, the protection is not, and nothing anywhere says so.