DKIM key uses an algorithm receivers reject
What this check looks for
Your key is published with a signing algorithm that receiving servers no longer accept, so signatures made with it are not verified.
Why it matters
The signature is present but worthless, which is the worst of both worlds: effort spent on DKIM with none of the protection.
When the check passes, your report says: “The DKIM key uses an algorithm receivers accept”.
What it costs your score
When this check fails it removes 10 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.dkim family ceiling of 30 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 10 points
- Family cap
- email-auth.dkim · 30
- Category
- Email authentication
- Module
- Email dkim
- Fix owned by
- mail provider
- In the ruleset since
- 2026.09
How to fix it
Sign with rsa-sha256, and publish an Ed25519 key only in addition to it.
SHA-1 signatures are rejected, and an Ed25519-only setup is unverifiable for receivers that do not support it.
Reconfigure the signer to use
rsa-sha256.Publish a fresh 2048-bit RSA key under a new selector if the current one is SHA-1 only.
Keep any Ed25519 selector as a second signature, never as the only one.
How to confirm it worked
dig +short TXT ‹selector›._domainkey.‹domain› — expect k=rsa and either no h= tag or h=sha256
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
‹selector›._domainkey.‹domain› advertises k=‹key type›/h=‹hash algorithms›. RFC 8301 §3.1 sunsets rsa-sha1 and requires rsa-sha256; RFC 8463 adds ed25519-sha256, which is safe to publish only alongside an RSA key because support is not universal.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.