DKIM Inspector

Looks up a DKIM selector's key record and parses it — key type, key length, and whether it's still in testing mode. DKIM has no discovery mechanism, so you need the selector from a real signed message's DKIM-Signature header (the s= tag) — this doesn't guess one.

What this checks

Whether a key record exists at selector._domainkey.domain.
Whether the public key (p= tag) parses at all, and whether it's been explicitly revoked (an empty p=).
Key type and length — RSA keys under 2048 bits are flagged as weak per RFC 8301.
Whether the selector is still marked as testing (t=y).

Read more in sending DMARC-compliant mail for others, or check a key you haven't published yet with the DKIM Validator.