Take the DKIM selector out of testing mode

Why it matters

The t=y flag tells receivers you are only testing DKIM, so they may treat failing signatures as if there were none. It defeats the point of signing once DKIM is working.

The fix

1. Send a test message to another provider and confirm the headers show dkim=pass with this selector.
2. Edit the selector's TXT record and remove t=y (leave other tags such as k=rsa and p= untouched). If the record has t=y:s, keep t=s; the s flag was set on purpose and only y should go.

; t=y removed (if the record had t=y:s, write t=s instead)
SELECTOR._domainkey.example.com.  IN TXT  "v=DKIM1; k=rsa; p=<PUBLIC KEY ALREADY IN YOUR RECORD>"

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DKIM selectors check
• Check that your mail is signed with DKIM
• Replace the weak DKIM key with a 2048-bit key
• Rotate the 1024-bit DKIM key to 2048 bits
• Fix the unusable DKIM key record
• Check that revoked DKIM selectors are meant to be revoked