DKIM record is in testing mode (t=y)
What this check looks for
Your DKIM record tells receivers to ignore any failures because you are still testing. Left in place, it means a genuine signature failure is never acted on.
Why it matters
Testing mode is meant for the first days of a rollout. Forgotten, it quietly weakens the protection you think you have.
When the check passes, your report says: “DKIM is live, not in testing mode”.
What it costs your score
When this check fails it removes 4 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.dkim family ceiling of 30 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- low
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 4 points
- Family cap
- email-auth.dkim · 30
- Category
- Email authentication
- Module
- Email dkim
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Remove the t=y flag once signing is confirmed working.
While it is set, receivers are asked to disregard signature failures.
Confirm outbound mail shows
dkim=passin the Authentication-Results header at an external mailbox.Edit the TXT record and remove the
t=ytag.
How to confirm it worked
dig +short TXT ‹selector›._domainkey.‹domain› — the record must not contain t=y
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
‹selector›._domainkey.‹domain› sets the t=y flag. RFC 6376 §3.6.1 defines it as meaning the domain is testing DKIM and asks verifiers not to treat messages differently on the basis of a failed signature.
Standards and references
- RFC 6376 §3.6.1 — Flags § 3.6.1
Test this on your domain
Run the check that produces this finding, on its own, against any domain.