Check that revoked DKIM selectors are meant to be revoked

Why it matters

A selector whose record has an empty p= tag is revoked, so mail signed with it cannot verify. That is correct for a retired key, but a problem if a service still signs with it.

The fix

1. If you retired the selector on purpose, nothing needs to change.
2. If a service still signs with it, publish an active key under that selector (or switch the service to a new selector) as shown by the mail service. If no active DKIM key remains at all, DMARC depends on SPF alone.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DKIM selectors check
• Check that your mail is signed with DKIM
• Replace the weak DKIM key with a 2048-bit key
• Rotate the 1024-bit DKIM key to 2048 bits
• Fix the unusable DKIM key record
• Take the DKIM selector out of testing mode