auth.dkim.missing

No DKIM Keys Found

What we check

We query DNS for DKIM public-key records at the common selectors (default, google, selector1, selector2, s1, and others). DKIM (DomainKeys Identified Mail) cryptographically signs outgoing mail so receivers can verify the message was authorized by the domain and not altered in transit.

What this finding means

No DKIM public keys were found at the selectors we probe. Either the domain doesn't sign its mail with DKIM, or it signs with a selector name we didn't guess — but for the common providers and defaults, nothing is published.

Because DKIM keys live at <selector>._domainkey.<domain> and the selector is chosen freely by the sender, a scanner can only probe well-known names. A domain using an unusual custom selector may sign correctly yet still show here.

Why it matters

No cryptographic authentication. Without DKIM, receivers can't verify that a message genuinely came from your domain and wasn't tampered with along the way. SPF checks the sending IP; DKIM checks the message itself.
DMARC needs it. DMARC passes on SPF or DKIM alignment. DKIM survives forwarding where SPF often breaks, so a DKIM-less domain fails DMARC on any forwarded or relayed mail.
Deliverability. Major providers expect DKIM signatures. Unsigned mail is more likely to be filtered.

How to fix

Enable DKIM signing at your mail provider or MTA. Most hosted platforms (Microsoft 365, Google Workspace) generate the key and give you the DNS record to publish; self-hosted MTAs use OpenDKIM, rspamd, or the built-in signer.

Publish the public key as a TXT record at <selector>._domainkey.<domain>:

selector1._domainkey.example.com.  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."

Use a 2048-bit RSA key and SHA-256 (RFC 8301). Send yourself a test message and confirm the DKIM signature verifies.

How it's graded

Missing DKIM carries a 25-point deduction in the Authentication category. See Grading Methodology for the full scoring model.

Evidence example

$ dig +short TXT default._domainkey.example.com
(empty)
$ dig +short TXT selector1._domainkey.example.com
(empty)
No DKIM key found at any probed selector