Check that DKIM keys are not known to be compromised

[mpalmer]

Use a well-maintained database of known-compromised keys, such as https://pwnedkeys.com, to mitigate the risks of the DKIM key(s) having been compromised.

[mimi89999]

I'm not quite sure about that service. It doesn't state how many keys it has in the database. It also doesn't state how many requests it will accept.

I found another tool: https://github.com/badkeys/badkeys

It is doing offline checks. It is also downloading a list of key hashes and checking against them locally.

[mpalmer]

As I understand it, mailgoose is a web application, that makes DNS requests to the Internet, in which case it's always online, pretty much by definition, so the only thing you get by using a downloaded database with offline checking is the guarantee that the list you're checking against is out-of-date.

To answer your other questions, there are approximately two million keys in the database, a number that is growing all the time, and there's no explicit rate limit because it's somewhat adaptive to the total load, so saying "you can do X requests per second" won't be accurate. On the other hand, "follow RFC6585 section 4, and if you find yourself needing moah powah, ask for an API key" is always going to be correct.

[mimi89999]

I tested around 6500 DKIM keys that I managed to collect with badkeys and none of them had any issues. I don't believe that it makes much sense to add badkeys to Mailgoose.

I also tried to search the key hashes in pwnedkeys.com, but couldn't do that because of the API rate limit.