DKIM adds a signature to every email you send, and receiving servers check it against a public key in your DNS. If DKIM isn't set up, or the key isn't published, the signature can't be checked, and your email is easier to spoof and more likely to be filtered. Turn DKIM on in your email service, then add the DNS record it gives you.
What's the problem
Email headers show dkim=none or dkim=fail, a checker can't find your DKIM record, or your email provider says DKIM isn't authenticating.
Why it happens
- DKIM was never turned on in the email service: many services need you to start it yourself.
- The DNS record wasn't added, or was added under the wrong name.
- Each sending service needs its own DKIM key, so mail from a newsletter tool or your website can fail even when your main mailbox passes.
How to fix it
- Turn on DKIM in each service that sends as your domain (Google Workspace, Microsoft 365, your newsletter or website mail service).
- Add the DNS record it gives you exactly as shown: usually a TXT or CNAME record named like
selector._domainkey. - Click verify or start authentication in the service once the record is visible.
- Send a test email and check the headers show
dkim=pass.
What Preventionlabs checks
One click runs the full report on your domain. For this problem it shows your email authentication: SPF (and its 10-lookup limit), DMARC and DKIM; whether mail to you must arrive encrypted (MTA-STS) and whether you get reports when it does not; your DNS: nameservers, addresses, DNSSEC, and records pointing at services that no longer exist. It can't see your sending provider's delivery logs, so check bounces there.
Run your free reportYour first report is free, no card needed. Then A$50 a month, up to 10 domains. Read-only: it never changes anything.
Sources
- Google: Email sender guidelineshelp center
DKIM helps protect your domain against spoofing by authenticating your email