We measured the email authentication of 105 B2B SaaS domains. One DKIM key signs for 62 of them.

On 21 September 2026 we read the public DNS of 105 well-known B2B SaaS domains — developer infrastructure, security vendors, fintech, healthtech, HR, AI labs — and measured what each one authorizes to send email as itself. Not a survey of opinions: 742 published DKIM keys, every SPF chain walked to its end, every key decoded to read its real modulus length. The single most surprising result is that those 742 keys are only 446 distinct keys.

How this was measured

Two engines, both of which also run as free tools on this site, pointed at public DNS and nothing else. No mail was sent, no host was connected to, nothing inside anyone’s systems was touched — every figure below comes from TXT and MX records that any resolver on the internet can read.

• —SPF: the record is walked to its end, following every include and redirect, counting DNS-querying mechanisms against the RFC 7208 limit of ten and merging every ip4 block in the whole chain to total the unique addresses authorized.
• —DKIM: selectors cannot be enumerated from DNS, so each domain is probed against 124 documented provider default selector names at <selector>._domainkey.<domain>. A random control name is probed first, so a domain answering every query with a wildcard is reported as a wildcard rather than as 124 findings.
• —Key sizes: every public key found was parsed with node:crypto to read its actual RSA modulus length, rather than inferred from the length of the base64 string.

Finding 1: 62 companies, one key

DKIM works because a receiver can check that a message was signed by someone holding the private key matching the public key in your DNS. So the interesting question is not how many keys a domain publishes — it is who else holds the matching private key.

We hashed the key material of all 742 keys we found and grouped identical ones. 742 keys collapsed to 446 distinct values. The largest group: zendesk1 and zendesk2, published on 62 different companies’ domains with byte-identical public keys. One private key, held by one vendor, can produce a valid DKIM signature as any of those 62 companies.

Scroll the table sideways →

This is how multi-tenant email platforms are built, and it is not a vulnerability report about any vendor on that list — a shared key with a well-run vendor is an ordinary, accepted trade. It is worth stating plainly anyway, because the usual mental model of DKIM is “my domain, my key”, and for most of these domains that is not what the DNS says. The practical consequence: a compromise of one of those signing keys is not one company’s incident.

Finding 2: the addresses nobody counts

Every SPF checker reports whether you are over ten lookups. Far fewer answer the question underneath it: how many machines can send mail as you right now? Merging every ip4 block in each chain, the median domain here authorizes 231,508 addresses. 80 of 105 authorize more than 100,000. 13 authorize more than half a million.

Scroll the table sideways →

Note the third column. Most of these domains are nowhere near the lookup limit — they are compliant records that happen to trust several shared provider ranges. The lookup count and the address count measure different things, and only one of them describes how much of the internet can send mail in your name.

Of the 105 domains, 5 exceed the limit of ten outright (gitlab.com at 13, drata.com at 13, airtable.com at 12, clickup.com at 13, fastspring.com at 14), and 8 sit exactly on ten — one new vendor away from PermError. Our guide to SPF lookup limits covers what to do about that, and why flattening moves the problem rather than removing it.

Finding 3: 1024-bit keys are still the norm

Of the keys we decoded, 379 are RSA-1024 and 361 are RSA-2048 — and 96 of 105 domains publish at least one 1024-bit key. That includes household-name security and infrastructure companies, which is the point: this is almost never a decision anyone made. It is the default key size a platform generated when the integration was switched on, sometimes years ago, and DKIM keys have no expiry to force a review.

RSA-1024 has been below recommended strength for general use for over a decade, and DNS TXT-record size limits are the historical reason email lagged behind. It is worth knowing which of yours are which; a receiver will happily validate a signature from a key weaker than you would choose today.

What the rest of the data says

• —DMARC is nearly universal at this tier: 71 of 105 publish p=reject and 31 p=quarantine. Only 2 sit at p=none, which monitors without enforcing, and 1 publishes no DMARC record at all.
• —SPF endings split 67 ~all to 38 -all. With DMARC enforcing on top, the practical difference is smaller than the debate about it suggests.
• —The median domain publishes 7 discoverable DKIM selectors. That is a rough count of how many separate platforms have been authorized to sign mail as it — marketing, support, billing, recruiting — and each one is a relationship someone has to remember exists.
• —3 domains returned no selector from the 124 probed, which means their DKIM uses names outside the documented defaults, not that they lack DKIM.

Why we ran it

Warden sells a bounded, fixed-price assessment of what a company exposes to the internet, so we spend a lot of time reading other people’s public DNS. This study is that work turned outward: the same two engines, run across a set of domains nobody has to take our word about, with the raw per-domain output kept so the numbers can be checked rather than believed.

You can run either engine against your own domain right now, for free, with no account: the SPF lookup and address counter and the DKIM selector finder. Both show every record they read as evidence. If your own numbers look like the medians above, that is not an emergency — it is a list of relationships worth confirming you still want.