dkim.public_key_strength Reviewed July 2026

Quick fix

Generate a modern DKIM key supported by all receiving and sending systems.

What this finding means

SecuTest measures the actual decoded public-key size. It does not infer strength from TXT length and does not penalize an undiscovered selector.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, or business intent when those cannot be proven remotely.

Why it matters

Security impact A weak DKIM key may not provide adequate resistance to key recovery or forgery over the intended lifetime.

Step-by-step fix

Where to make the change

  • The authoritative DNS zone for the domain.
  • The outbound mail platform or email-security gateway when signing or sender authorization is involved.
  • The DMARC reporting mailbox or reporting service when aggregate reports are required.

Remediation procedure

  1. Generate a modern DKIM key supported by all receiving and sending systems.
  2. Publish it under a new selector.
  3. Enable dual-signing or staged rollout when the platform supports it.
  4. Retire the old selector after propagation and verification.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, or provider values shown in your SecuTest evidence.

Inspect public DNS
dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short MX example.com

Inspect a DKIM selector
dig +short TXT selector._domainkey.example.com

Verify the fix

  1. Decode the published key and inspect its bit length.
  2. Send signed mail through every legitimate platform.
  3. Confirm dkim=pass and DMARC alignment.
  4. Repeat the SecuTest scan.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Replacing the key in place without coordinating the private key.
  • Measuring base64 character count instead of actual key size.
  • Removing the old selector before delayed mail is verified.

Authoritative references