Finding: No DKIM Record Found at Common Selectors
This finding means Nivaronix found no DKIM (DomainKeys Identified Mail) signing key at any of the selector names mail providers commonly use. Without DKIM, receivers have no way to verify that mail claiming to be from your domain wasn't altered in transit or was actually signed by an authorized sender.
Last updated August 12, 2026.
What it means
DKIM records live at <selector>._domainkey.<your-domain>, where the selector is a name your mail provider chooses. Nivaronix queried a list of common selectors for this domain and found no TXT record shaped like a DKIM key at any of them.
Why it matters
Without a DKIM signature, a receiving mail server can only lean on SPF (which authorizes sending IPs, not message content) to judge whether mail is legitimate. DKIM proves the message wasn't altered in transit and was signed by something authorized for this domain. It also feeds directly into DMARC alignment — many receivers weight DKIM-signed, aligned mail more heavily when deciding whether to deliver, quarantine, or reject.
What Nivaronix checks
Nivaronix checks DKIM by querying a fixed list of common selectors — default, google, selector1, selector2, k1, dkim, mail — at <selector>._domainkey.<your-domain> and looking for a TXT record shaped like a DKIM key. It stops at the first selector that resolves. This is a presence check at known selector names, not a directory lookup: DKIM has no public registry of selectors, so a domain signing mail with a selector outside this list will show as "no DKIM record found" even though DKIM is actually configured. Nivaronix also does not validate DKIM signatures on live mail — it does not verify that a specific message was actually signed correctly, only whether a usable public key is published at a selector it checked.
This finding fires specifically when every common-selector lookup completes cleanly and none of them return a usable DKIM key record. If a lookup instead fails outright (timeout, SERVFAIL), Nivaronix reports that separately as an inconclusive check rather than claiming DKIM is absent — a failed lookup could be hiding a record we simply couldn't reach.
Important limitation
This is not conclusive proof your domain has no DKIM configured anywhere. If your mail provider uses a selector outside the common list Nivaronix checks — which does happen, especially with custom or self-hosted mail setups — a real DKIM record will not be found by this check even though DKIM is working correctly. If you know your provider's selector, verify it directly with dig TXT <your-selector>._domainkey.<your-domain> before assuming DKIM is unconfigured.
Example evidence (illustrative — not live scan data)
TXT <selector>._domainkey.example.com: no usable DKIM key record at default, google, selector1, selector2, k1, dkim, mail
How to fix it
- Open your mail provider's DKIM setup page (Google Workspace, Microsoft 365, or your ESP's admin console) and generate a DKIM key if one isn't already active.
- Publish the TXT record it gives you at the selector name it specifies.
- Enable DKIM signing on outgoing mail in the provider's settings.
- Allow DNS propagation, then re-run the scan.
How to verify the fix
Re-run the DNS security checker and confirm it now reports a DKIM record at one of the common selectors. If your provider uses a non-standard selector, confirm directly with diginstead — this scan won't find it.