Skip to content

Email-domain security

What is DKIM?

Whether DKIM keys are published at the selectors common mail services use. Selectors cannot be listed from outside, so a key under another name is not ruled out.

Part of the External Security Check. Free during the preview.

What it checks

Whether DKIM keys are published at the selectors common mail services use. Selectors cannot be listed from outside, so a key under another name is not ruled out.

A pass means: DKIM keys were found for common selectors.

Possible findings

DKIM could not be confirmed

Severity: InformationConfidence: PotentialKind: Informational

Potential: inferred rather than observed. Confirm it before acting.

What we found

No DKIM key was found at the common selectors Ironfang checks.

Why it matters

DKIM keys live at selector names chosen by each mail service, and there is no way to list them from outside. Your domain may well have DKIM under a selector we did not try, so this is not a finding of a problem.

How to fix it

Confirm in your mail service (Google Workspace, Microsoft 365 and others) that DKIM signing is turned on for the domain.

References