Fix the unusable DKIM key record

Why it matters

The DKIM record does not hold a key receivers can use, so mail signed with that selector fails DKIM. The usual causes are a truncated paste, extra characters or a wrong key type.

The fix

1. Open the selector named in the finding. The record must contain v=DKIM1 (optional), k=rsa (or ed25519) and p= followed by the full base64 public key.
2. Copy the value again from the service that signs your mail. If it is lost or you cannot tell what it should be, generate a new key there and publish it under a new selector.
3. Check that long values were not cut off and that the DNS panel did not add extra quotes or line breaks. Whitespace inside p= is ignored, but missing characters are not.
4. Send a test message to another provider and check the headers show dkim=pass.

; Name and value come from the service that signs your mail
; A 2048-bit key is split into quoted strings of at most 255 characters each, joined by receivers
SELECTOR._domainkey.example.com.  IN TXT  ( "v=DKIM1; k=rsa; " "p=<FIRST PART OF THE PUBLIC KEY>" "<REST OF THE PUBLIC KEY>" )

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DKIM selectors check
• Check that your mail is signed with DKIM
• Replace the weak DKIM key with a 2048-bit key
• Rotate the 1024-bit DKIM key to 2048 bits
• Check that revoked DKIM selectors are meant to be revoked
• Take the DKIM selector out of testing mode