dkim.public_key_present Reviewed July 2026

Quick fix

Check current DKIM-Signature headers for use of the selector.

What this finding means

An empty p= value revokes a selector under DKIM. SecuTest distinguishes this from an active key but cannot determine from DNS alone whether senders still use the revoked selector.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, or business intent when those cannot be proven remotely.

Why it matters

Security impact A DKIM record without an active public key cannot validate signatures and may represent an incomplete or unintended revocation.

Step-by-step fix

Where to make the change

  • The authoritative DNS zone for the domain.
  • The outbound mail platform or email-security gateway when signing or sender authorization is involved.
  • The DMARC reporting mailbox or reporting service when aggregate reports are required.

Remediation procedure

  1. Check current DKIM-Signature headers for use of the selector.
  2. Publish the correct public key before enabling signing with that selector.
  3. If revocation is intentional, stop all senders from using the selector.
  4. Retain old keys only for the period required by message-verification policy.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, or provider values shown in your SecuTest evidence.

Inspect public DNS
dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short MX example.com

Inspect a DKIM selector
dig +short TXT selector._domainkey.example.com

Verify the fix

  1. Run: dig +short TXT selector._domainkey.example.com
  2. Confirm p= contains the expected active key or that the selector is intentionally revoked.
  3. Send a message and verify dkim=pass with the intended selector.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Restoring a private key instead of the public key.
  • Revoking a selector while senders still sign with it.
  • Assuming an empty p= is equivalent to NXDOMAIN.

Authoritative references