DKIM record cannot be parsed
What this check looks for
The record published for this selector is not a valid DKIM key record, so receivers cannot verify signatures made with it.
Why it matters
A broken key record fails the same way a missing one does, but is harder to notice because something is clearly published.
When the check passes, your report says: “The DKIM record parses as a valid key record”.
What it costs your score
When this check fails it removes 18 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.dkim family ceiling of 30 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- high
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 18 points
- Family cap
- email-auth.dkim · 30
- Category
- Email authentication
- Module
- Email dkim
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Republish the key record exactly as your provider generated it.
An unparseable key record means signatures made with this selector cannot be verified.
Copy the record from your mail provider again, without reformatting it.
If the value exceeds 255 characters, make sure your DNS host stores it as one TXT record with multiple strings, not as multiple records.
How to confirm it worked
dig +short TXT ‹selector›._domainkey.‹domain› — the value must parse in the DKIM checker
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
Parsing ‹selector›._domainkey.‹domain› failed: ‹parse error›. Per RFC 6376 §3.6.1 the record is a tag=value list; the most common breakages are a base64 p= value split into separate TXT records instead of concatenated strings, whitespace injected by a control panel, and a missing v=DKIM1 tag when one is required by the provider.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.