Check that your mail is signed with DKIM on Cloudflare

Why it matters

The scan only probes common selector names, so this does not prove DKIM is missing, but without it DMARC relies on SPF alone and forwarded mail can fail DMARC. DKIM lets receivers verify the message was not altered and really came from your domain.

The fix

1. Turn on DKIM signing in the mail service first; it shows the selector name and the value to publish.
2. In the Cloudflare dashboard open DNS > Records > Add record. Use the type the service asks for: TXT with Name the selector (for example selector1._domainkey) and Content the value, or CNAME with Proxy status DNS only (grey cloud).

Type:     TXT
Name:     SELECTOR._domainkey.example.com
Content:  v=DKIM1; k=rsa; p=<PUBLIC KEY FROM YOUR MAIL SERVICE>

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DKIM selectors check
• Replace the weak DKIM key with a 2048-bit key
• Rotate the 1024-bit DKIM key to 2048 bits
• Fix the unusable DKIM key record
• Check that revoked DKIM selectors are meant to be revoked
• Take the DKIM selector out of testing mode