auth.dkim.revoked
DKIM Key Revoked
What we check
We inspect the DKIM TXT records for an empty p= tag. In DKIM, the p= tag carries the base64 public key; RFC 6376 defines an empty p= value as an explicit signal that the key has been revoked.
What this finding means
One or more DKIM selectors on this domain publish a record with p= and nothing after it. That is not a broken record — it's a deliberate revocation. A revoked key can no longer validate signatures, so any mail still signed with the matching private key will fail DKIM.
Why it matters
- Signatures fail. If your signer is still using the private key whose public counterpart you revoked, every message it signs fails DKIM at the receiver.
- Usually intentional, sometimes stale. Revocation is the correct way to retire a compromised or rotated-out key. The problem is when a selector is revoked but the mail flow still points at it.
- DMARC impact. A failing DKIM signature means no DKIM alignment. If SPF alignment is also absent, DMARC fails.
How to fix
If the revocation is intentional and the key is retired, make sure nothing still signs with it. Point your signer at the current, valid selector and confirm outgoing mail verifies.
If the revocation was a mistake, re-publish the public key for that selector:
selector1._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."Clean up dead selectors. Once a revoked selector is genuinely unused, you can remove the record entirely rather than leaving the empty
p=in place.
How it's graded
A revoked DKIM key carries a 20-point deduction in the Authentication category. See Grading Methodology for the full scoring model.
Evidence example
$ dig +short TXT selector1._domainkey.example.com
"v=DKIM1; p="
^ empty p= tag → key revoked (RFC 6376)