DKIM 金鑰怎麼查是 1024 還是 2048 位元？從郵件標頭到 selector 輪替

1
import base64
2
import shlex
3
import subprocess
4

5
domain, selector = "example.com", "mail2026"
6
name = f"{selector}._domainkey.{domain.rstrip('.')}."
7
result = subprocess.check_output(["dig", "+short", "TXT", name], text=True)
8
records = [line for line in result.splitlines() if line.startswith('"')]
9
if len(records) != 1:
10
    raise SystemExit(f"{name}: expected exactly one TXT record, got {len(records)}")
11

12
# dig 在同一行列出一筆 TXT 的多個字串片段。
13
record = "".join(shlex.split(records[0]))
14
tags = dict(
15
    (key.strip(), value.strip())
16
    for key, value in (field.split("=", 1) for field in record.split(";") if "=" in field)
17
)
18
if tags.get("k", "rsa").lower() != "rsa":
19
    raise SystemExit("This selector does not use RSA")
20
if not tags.get("p"):
21
    raise SystemExit("Missing or revoked DKIM public key")
22

23
key = base64.b64decode("".join(tags["p"].split()), validate=True)
24
public_key = subprocess.check_output(
25
    ["openssl", "pkey", "-pubin", "-inform", "DER", "-text", "-noout"],
26
    input=key,
27
)
28
print(name, public_key.decode().splitlines()[0])