DKIM authenticationWhat it checks and how to fix it

What it checks

Probes about forty common DKIM selectors (google, selector1 and selector2 for Microsoft 365, k1 for Mailchimp, s1, s2, mandrill, zoho, protonmail and others) at <selector>._domainkey.<domain>, ignoring revoked keys with an empty p= value. Passes when a published key is found, or when none is found but DMARC is enforced with quarantine or reject; otherwise warns, since the domain may use a selector outside the list.

Why it matters

DKIM signs each outgoing message with a key published in your DNS, so receivers can verify it came from you and was not altered in transit. Gmail and Yahoo require DKIM from bulk senders, and unsigned mail is more likely to land in spam. DMARC needs DKIM or SPF to align, and DKIM is the one that survives forwarding.

How to fix it

Turn on DKIM signing in every service that sends mail as your domain and publish the record it gives you (a TXT record with the public key, or a CNAME to the provider's key).

• Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email → Generate new record (2048-bit), publish it, then click "Start authentication".
• Microsoft 365: Defender portal → Email authentication settings → DKIM, publish the two CNAMEs it shows, then enable signing.
• Mailchimp, SendGrid, Postmark, Amazon SES and others: the "domain authentication" page lists the records to add.

google._domainkey.example.com.     3600  IN  TXT    "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOC..."
selector1._domainkey.example.com.  3600  IN  CNAME  selector1-example-com._domainkey.contoso.onmicrosoft.com.

Use 2048-bit keys. A 2048-bit key is longer than 255 characters, so it must be split into several strings within one TXT record; Cloudflare and most DNS dashboards do this for you.

dig +short TXT google._domainkey.example.com

Then send yourself a message and check that its Authentication-Results header shows dkim=pass.