auth.dkim.testing_mode
DKIM Testing Mode Enabled
What we check
We inspect the t= flags tag of the DKIM key record for the y flag. The y flag marks the domain as testing DKIM: RFC 6376 tells verifiers not to treat mail from a testing signer any differently from unsigned mail, even if the signature fails.
What this finding means
A DKIM selector on this domain has t=y set. In testing mode, receivers are instructed to ignore DKIM failures for this key — which means the signature provides no enforcement value. It's the DKIM equivalent of running DMARC at p=none: useful while you validate signing, pointless to leave on afterward.
Why it matters
- No real protection. As long as
t=yis set, a receiver won't act on a bad signature, so DKIM isn't defending anything. - Leftover from setup. Testing mode is meant for the initial rollout window. A selector that's been signing correctly for weeks with
t=ystill on is just an unfinished deployment. - Undercuts DMARC. DMARC leans on DKIM as one of its two alignment signals. A testing-mode key weakens that leg of your DMARC posture.
How to fix
Remove the
yflag once you've confirmed signing works. Either drop thet=tag entirely or set it withouty:selector1._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."Verify first. Before removing testing mode, confirm a test message's DKIM signature verifies cleanly — that's the whole point testing mode was protecting.
How it's graded
DKIM testing mode carries a 5-point deduction in the Authentication category. See Grading Methodology for the full scoring model.
Evidence example
$ dig +short TXT selector1._domainkey.example.com | tr -d '"'
v=DKIM1; k=rsa; t=y; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...
^^^ testing mode — receivers ignore DKIM failures for this key