No DKIM key found for any known selector
What this check looks for
We could not find a DKIM signing key published for your domain. DKIM is the cryptographic signature that proves a message really came from you and was not altered on the way.
Why it matters
Without DKIM your mail depends entirely on SPF, which breaks whenever a message is forwarded. It is also the harder of the two requirements in the bulk-sender rules Google and Yahoo enforce.
When the check passes, your report says: “A DKIM signing key is published and readable”.
What it costs your score
When this check fails it removes 25 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.dkim family ceiling of 30 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- high
- Default confidence
- medium
- Status when triggered
- fail
- Deduction
- 25 points
- Family cap
- email-auth.dkim · 30
- Category
- Email authentication
- Module
- Email dkim
- Fix owned by
- mail provider
- In the ruleset since
- 2026.09
How to fix it
Enable DKIM signing at your mail provider and publish the key it gives you.
DKIM survives forwarding, where SPF does not, and is required by the major bulk-sender rules.
Turn on DKIM in your mail provider's admin console — most generate the key pair for you and show the DNS record to publish.
For a self-hosted mail server, generate a 2048-bit RSA key pair and publish the public half.
Publish the TXT record at
<selector>._domainkey.‹domain›.Send a test message to an external address and confirm the Authentication-Results header shows
dkim=pass.
How to confirm it worked
dig +short TXT ‹selector›._domainkey.‹domain› — expect a v=DKIM1 record with a p= value
Send yourself a message and check the Authentication-Results header for dkim=pass, or use "Test again".
{{selector}}._domainkey.{{domain}}. 3600 IN TXT "v=DKIM1; k=rsa; p={{publicKey}}"A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Remediation by platform
‹selector›._domainkey.‹domain›. 3600 IN TXT "v=DKIM1; k=rsa; p=‹public key›"Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM → select ‹domain› → Create DKIM keys, then publish the two CNAME records it shows.Google Admin → Apps → Google Workspace → Gmail → Authenticate email → Generate new record (2048-bit) → publish the TXT record shown → Start authentication.SES console → Verified identities → ‹domain› → DomainKeys Identified Mail (DKIM) → Easy DKIM, then publish the three CNAME records SES generates.Technical detail
No ‹selector›._domainkey.‹domain› TXT record was found for any of the ‹selectors tried› selectors we probe (the defaults published by the major mailbox and transactional providers). DKIM selectors cannot be enumerated from DNS, so this check is a probe of known names rather than an exhaustive search: if you use a custom selector, supply it and re-run. Per RFC 6376 §3.6.2 the key is published as a TXT record at <selector>._domainkey.<domain>.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.