No DKIM key found at the selectors checked
Updated
What this check looks for
We didn't find a DKIM key under the selector names we checked: the ones mail providers normally use, or the one you entered. If you sign with another selector, enter it or paste the header of an email you sent, and re-test. If you don't sign mail at all, set up DKIM — the signature that proves a message came from you.
Why it matters
Without DKIM your mail depends entirely on SPF, which breaks whenever a message is forwarded. It is also the harder of the two requirements in the bulk-sender rules Google and Yahoo enforce.
When the check passes, your report says: “A DKIM signing key is published and readable”.
What it costs your score
When this check fails it removes 25 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.dkim family ceiling of 30 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- high
- Default confidence
- medium
- Status when triggered
- fail
- Deduction
- 25 points
- Family cap
- email-auth.dkim · 30
- Category
- Email authentication
- Module
- Email dkim
- Fix owned by
- mail provider
- In the ruleset since
- 2026.09
How to fix it
Enable DKIM signing at your mail provider and publish the key it gives you.
DKIM survives forwarding, where SPF does not, and is required by the major bulk-sender rules.
Turn on DKIM in your mail provider's admin console — most generate the key pair for you and show the DNS record to publish.
For a self-hosted mail server, generate a 2048-bit RSA key pair and publish the public half.
Publish the TXT record at
<selector>._domainkey.‹domain›.Send a test message to an external address and confirm the Authentication-Results header shows
dkim=pass.
How to confirm it worked
dig +short TXT ‹selector›._domainkey.‹domain› — expect a v=DKIM1 record with a p= value
Send yourself a message and check the Authentication-Results header for dkim=pass, or use "Test again".
{{selector}}._domainkey.{{domain}}. 3600 IN TXT "v=DKIM1; k=rsa; p={{publicKey}}"A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Remediation by platform
‹selector›._domainkey.‹domain›. 3600 IN TXT "v=DKIM1; k=rsa; p=‹public key›"Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM → select ‹domain› → Create DKIM keys, then publish the two CNAME records it shows.Google Admin → Apps → Google Workspace → Gmail → Authenticate email → Generate new record (2048-bit) → publish the TXT record shown → Start authentication.SES console → Verified identities → ‹domain› → DomainKeys Identified Mail (DKIM) → Easy DKIM, then publish the three CNAME records SES generates.Technical detail
No <selector>._domainkey.‹domain› TXT record carrying a key was found for any of the selectors asked about: ‹selectors tried›. When you did not name a selector, these are the defaults mail providers document (the provider your MX records point to first), and the result is a warning rather than a failure: DKIM selectors cannot be enumerated from DNS, so this is a probe of known names, not an exhaustive search. When you named the selector, no key there is a confirmed failure. Per RFC 6376 §3.6.2 the key is published as a TXT record at <selector>._domainkey.<domain>.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.