Entering a DKIM domain into the new DNS monitor for TXT record type currently returns a “Must be a valid IP address or hostname” error. (selector)._domainkey.(some.top.level.here) IS the (sub)domain URI. The value of the TXT record is an encoded string that serves as a decryption key. Example:
;; QUESTION SECTION:
;dkim1._domainkey.e.epiqnotice.com. IN TXT
;; ANSWER SECTION:
dkim1._domainkey.e.epiqnotice.com. 59 IN TXT "v=DKIM1; " "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7Efi5iLvE1A+6J3u+qqN8a9KG" "4b6HFaZj9U/s6sGHcfpDpsBsyV2rCb1OGabneUYfR3x8Bn16n/kbtQ1NDqo8E/7+" "LpvmNALGjGTWA6X1GiplhJZZTfMGsPBhZyx1chaGPRVC0EiPhnARXzvnp+6oFKq4" "9Gn0lNS9h1GE8k3eGwIDAQAB"The top level domain creates a subdomain “_domainkey” which has no records of its own. Inside that subdomain there are further subdomains (in this example “dkim1”) each of which selects a decryption key. Inside that subdomain is the TXT record with the value of that decryption key. There do not need to be any records aside from that one TXT, so whatever is being tested to determine “valid” is too restrictive.
Full spec is here: https://datatracker.ietf.org/doc/html/rfc6376
