Check that your mail is signed with DKIM

Why it matters

The scan only probes common selector names, so this does not prove DKIM is missing, but without it DMARC relies on SPF alone and forwarded mail can fail DMARC. DKIM lets receivers verify the message was not altered and really came from your domain.

The fix

1. Find out your real selector: send a message from your domain to an address elsewhere, open the original source and look for the DKIM-Signature header; the s= value is the selector and d= the signing domain. If d= is your domain and the selector exists in DNS, DKIM is already working and this finding can be ignored.
2. If there is no DKIM-Signature, turn on DKIM signing in each service that sends your mail and publish the key that service gives you. Examples: Google Workspace Admin console > Apps > Google Workspace > Gmail > Authenticate email; Microsoft 365 Defender portal > Email authentication settings > DKIM.
3. Use 2048-bit keys, and publish the record the service shows exactly under the selector name it gives.

; Name and value come from the service that signs your mail
; A 2048-bit key is split into quoted strings of at most 255 characters each, joined by receivers
SELECTOR._domainkey.example.com.  IN TXT  ( "v=DKIM1; k=rsa; " "p=<FIRST PART OF THE PUBLIC KEY>" "<REST OF THE PUBLIC KEY>" )

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DKIM selectors check
• Replace the weak DKIM key with a 2048-bit key
• Rotate the 1024-bit DKIM key to 2048 bits
• Fix the unusable DKIM key record
• Check that revoked DKIM selectors are meant to be revoked
• Take the DKIM selector out of testing mode