auth.dkim.strict_mode

DKIM Strict Alignment Enabled

What we check

We inspect the t= flags tag of the DKIM key record for the s flag. With t=s, RFC 6376 §3.6.1 requires the signing domain (d=) to exactly match the domain of the agent identity (i=) in every signature made with this key.

What this finding means

A DKIM selector on this domain sets t=s, so signatures made with this key only verify when the d= domain and the i= identity domain match exactly. Without the flag, a signature for d=example.com also covers identities on any subdomain — i=@mail.example.com, i=@anything.example.com — which is convenient, but wider than many domains ever need.

This is an informational note about hardening posture, not a problem. It does not change the grade.

Why it matters

• Closes a subdomain vector. Without strict alignment, anyone able to obtain a signature under the parent key — a misconfigured internal service, a compromised subdomain sender — produces mail that verifies for identities across the whole domain tree. t=s confines the key to its exact domain.
• Defense in depth, not a substitute. DMARC's adkim=s enforces a similar alignment at the policy layer; t=s enforces it at the key itself, so it holds even for receivers that check DKIM without DMARC.

When strict mode is wrong for you

If you legitimately sign mail for subdomains with the parent domain's key (d=example.com with i=@news.example.com), t=s breaks those signatures. In that setup, either drop the flag or give each subdomain its own key and selector — the second option keeps the hardening.

How to set it

Add s to the t= tag of the DKIM key record:

v=DKIM1; k=rsa; t=s; p=MIIBIjANBgkq...

Flags combine with a colon: a key still in testing that should also be strict is t=y:s.