Take the DKIM selector out of testing mode on Cloudflare

Why it matters

The t=y flag tells receivers you are only testing DKIM, so they may treat failing signatures as if there were none. It defeats the point of signing once DKIM is working.

The fix

1. In the Cloudflare dashboard open DNS > Records, find the selector's TXT record under _domainkey and choose Edit.
2. Delete t=y from Content (and its semicolon), keep the rest unchanged, and save. If it says t=y:s, change it to t=s.

Type:     TXT
Name:     SELECTOR._domainkey.example.com
Content:  v=DKIM1; k=rsa; p=<PUBLIC KEY ALREADY IN YOUR RECORD>

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DKIM selectors check
• Check that your mail is signed with DKIM
• Replace the weak DKIM key with a 2048-bit key
• Rotate the 1024-bit DKIM key to 2048 bits
• Fix the unusable DKIM key record
• Check that revoked DKIM selectors are meant to be revoked