Scan rule · RSC-SEC-088
No DKIM key found under common selectors
Queries a handful of common DKIM selectors and reports when none of them holds a key — a hint, not a finding of absence.
Why this matters
DKIM signs every outgoing mail with a key whose public half lives in DNS — under a name (selector) chosen by the mail provider. Because the selector is arbitrary, a scan can only guess: we query the common names (`google`, `selector1`, `default` …). “Not found” therefore means exactly that — not “missing”.
If DKIM really is not set up, your mail carries no signature and DMARC can only lean on SPF. SPF breaks on forwarding; DKIM survives it. Both together is what large receivers now expect.
Check it yourself: look under “DKIM” or “domain authentication” at your mail provider — the selector is listed there. Then run `dig TXT <selector>._domainkey.your-domain.com +short`.
Scan tier
How to fix it
Check in your mail provider whether DKIM is enabled and publish the selector record it issues in DNS.