Add DKIM selector variant check for domains that do not send mail

[mbainter]

When you do not send mail from a domain, it is best practice to have a setup like:

• SPF: -all
• DMARC: policy to reject with strict spf/dkim alignment
• A wildcard record of *._domainkey.domain.com with the value "v=DKIM1;p="

And if it doesn't receive mail either, a null MX record ("domain.com IN MX .")
The current DKIM check in the email security policy would technically already allow you to check that the selector exists but would think that the record is misconfigured. A variant that can detect this situation and recognize it as a valid configuration would be helpful.