From 96edd292579d9c7383f6a8959971cb8169f8a8da Mon Sep 17 00:00:00 2001
From: s4ge <shrey.sneh650@gmail.com>
Date: Sat, 29 Aug 2026 17:46:00 -0600
Subject: [PATCH] Expand the common DKIM selector probe list

Probe additional stable, documented selectors used by major
providers so DKIM presence is less often reported as undetected.
Skip per-tenant dynamic selectors.
---
 src/sentineldeck/scanners/email_security.py | 36 +++++++++++++++++++--
 tests/test_email_security.py                |  6 ++++
 2 files changed, 39 insertions(+), 3 deletions(-)

diff --git a/src/sentineldeck/scanners/email_security.py b/src/sentineldeck/scanners/email_security.py
index 48b89df..b35d43d 100644
--- a/src/sentineldeck/scanners/email_security.py
+++ b/src/sentineldeck/scanners/email_security.py
@@ -16,12 +16,42 @@
 
 # Best-effort DKIM selector probes. Absence is inconclusive, so DKIM findings
 # are always reported with indeterminate confidence.
+# Only static, publicly documented selectors. Skip per-tenant tokens
+# (Amazon SES, Postmark dates, HubSpot hs1-<id>, etc.).
 COMMON_DKIM_SELECTORS = (
-    "default", "google", "selector1", "selector2", "k1", "k2",
-    "mail", "dkim", "s1", "s2", "mandrill", "zoho", "protonmail", "fm1",
+    "default",       # generic / self-hosted
+    "mail",          # generic / Brevo legacy
+    "mail2",         # Brevo / Sendinblue rotation pair
+    "dkim",          # generic / self-hosted
+    "google",        # Google Workspace
+    "google2",       # Google Workspace key rotation
+    "selector1",     # Microsoft 365
+    "selector2",     # Microsoft 365 key rotation
+    "k1",            # Mailchimp
+    "k2",            # Mailchimp
+    "k3",            # Mailchimp
+    "mte1",          # Mailchimp Transactional
+    "mte2",          # Mailchimp Transactional
+    "mandrill",      # legacy Mailchimp Transactional
+    "s1",            # SendGrid
+    "s2",            # SendGrid
+    "zoho",          # Zoho Mail
+    "zmail",         # Zoho Mail common default
+    "protonmail",    # Proton Mail
+    "protonmail2",   # Proton Mail key rotation
+    "protonmail3",   # Proton Mail key rotation
+    "fm1",           # Fastmail
+    "fm2",           # Fastmail
+    "fm3",           # Fastmail
+    "sig1",          # Apple iCloud custom domain
+    "s1024",         # legacy Yahoo / AOL
+    "s2048",         # legacy Yahoo / AOL
+    "zendesk1",      # Zendesk
+    "zendesk2",      # Zendesk
+    "brevo1",        # Brevo
+    "brevo2",        # Brevo
 )
 
-
 def extract_spf_policy(record: str | None) -> str | None:
     if not record:
         return None
diff --git a/tests/test_email_security.py b/tests/test_email_security.py
index 2977f84..0dbe356 100644
--- a/tests/test_email_security.py
+++ b/tests/test_email_security.py
@@ -6,6 +6,7 @@
 from sentineldeck.risk.scoring import build_findings
 from sentineldeck.scanners.dns_lookup import parse_mx_records, parse_txt_records
 from sentineldeck.scanners.email_security import (
+    COMMON_DKIM_SELECTORS,
     analyze_email_security,
     count_spf_lookups,
     dkim_key_bits,
@@ -203,3 +204,8 @@ def test_email_findings_are_indeterminate_when_dns_errors():
 
     assert findings["spf-missing"].confidence == "indeterminate"
     assert findings["dmarc-missing"].confidence == "indeterminate"
+
+def test_common_dkim_selectors_are_unique_and_include_documented_providers():
+    assert len(COMMON_DKIM_SELECTORS) == len(set(COMMON_DKIM_SELECTORS))
+    for name in ("k3", "mte1", "protonmail2", "fm3", "sig1", "zendesk1", "google2"):
+        assert name in COMMON_DKIM_SELECTORS
\ No newline at end of file