auth.dkim.lookup_error
DKIM DNS Lookup Failed
What we check
We query DNS for DKIM public-key records at the common selectors. This finding is emitted when the lookup returned an error — a timeout or server failure — rather than a definitive answer, so DKIM status is indeterminate.
What this finding means
A DKIM DNS query didn't complete. This is not a statement that DKIM is missing or misconfigured — the scanner simply couldn't get a clean answer during this run. The keys may be published and working; the lookup just failed transiently.
Why it matters
- Usually transient. A one-off timeout typically clears by itself. If it recurs, it points at DNS reliability at your authoritative servers rather than a DKIM problem.
- Can affect real verification. If receivers hit the same DNS failure when verifying a signature, DKIM evaluation is deferred or treated as temporary error — which can slow delivery.
- Not a scored fault. Because it's an availability issue, not a configuration defect, it doesn't count against your grade.
How to fix
Re-scan. A transient lookup failure usually won't reproduce.
If it persists, check the DNS servers authoritative for
_domainkey.<domain>— confirm they answer reliably and aren't rate-limiting:dig +short TXT selector1._domainkey.example.com dig +short TXT default._domainkey.example.com
How it's graded
A DKIM lookup failure is a warning and carries no point deduction — the result is indeterminate, not a defect. See Grading Methodology for the full scoring model.
Evidence example
$ dig TXT selector1._domainkey.example.com
;; connection timed out; no servers could be reached
DKIM status: indeterminate (DNS lookup failed)