Comment by teddyh

They also seem to have DKIM. To find out, first we need an authoritative name server for id.apple.com:

  $ dig +short id.apple.com NS
  ns1-235.akam.net.
  ns1-45.akam.net.
  asia3.akam.net.
  asia2.akam.net.
  eur5.akam.net.
  usw2.akam.net.
  usw6.akam.net.
  use1.akam.net.

We pick an arbitrary nameserver and see if the _domainkey subdomain gives NXDOMAIN or NORERROR:

  $ dig +noall +comments +norecurse @ns1-235.akam.net _domainkey.id.apple.com TXT | grep HEADER
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12521

Good, it gives NOERROR, which indicates the existence of subdomains. Just to be sure, we check some other arbitrary non-existing subdomain, to see if it gives NXDOMAIN as it should:

  $ dig +noall +comments +norecurse @ns1-235.akam.net zojglgrcqk.id.apple.com TXT | grep HEADER
  ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 5653

Since it gives the expected NXDOMAIN, this strongly indicates that there are DNS records present on subdomains of “_domainkey.id.apple.com”; i.e. DKIM keys.

(Of course, if you have ever recieved e-mail from an address @id.apple.com, you would see the selector name in the DKIM signature header, and could look up the corresponding DKIM record directly. The above method is for when you don’t have access to that.)