auth.dkim.missing_null_mx

No DKIM Keys (Null MX Domain)

What we check

We query DKIM public-key records at common selectors. This finding is emitted when none exist and the domain publishes a Null MX (RFC 7505), declaring that it receives no mail.

What this finding means

On an ordinary mail domain, missing DKIM keys are a failure. On a Null MX domain they may simply mean the domain sends no mail either — in which case there is nothing to sign and nothing to publish. The scanner cannot observe sending, so this is reported as information rather than a verdict.

A stricter posture for a parked domain is to publish revoked keys (v=DKIM1; p=) at the common selectors, which makes it impossible for anyone to forge a validating signature; see DKIM Keys Revoked (Null MX Domain).

Why it matters

If the domain sends mail, it needs active keys: without DKIM, its mail cannot pass DMARC via DKIM alignment and depends entirely on SPF.
If it does not, the spoofing protection that matters is v=spf1 -all and a DMARC p=reject policy — both are graded in the Auth category.

How to fix

Nothing, if the domain sends no mail (optionally publish revoked keys as belt-and-braces). If it does send mail, configure DKIM signing at your mailer and publish the public key at the selector it uses.

How it's graded

Informational — no deduction. See Grading Methodology.

Evidence example

default._domainkey.example.com  TXT  (no record)
example.com                     MX   0 .