dkim.record_syntax Reviewed July 2026

Quick fix

Correct malformed tags and ensure the record begins with v=DKIM1 where present.

What this finding means

The scanner parses the DKIM key record, tag separators, version, key type, flags, and public-key value. It evaluates DNS publication, not whether every outgoing message is signed.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, or business intent when those cannot be proven remotely.

Why it matters

Security impact Malformed DKIM tags can make an otherwise published key unusable and cause signature verification failures.

Step-by-step fix

Where to make the change

  • The authoritative DNS zone for the domain.
  • The outbound mail platform or email-security gateway when signing or sender authorization is involved.
  • The DMARC reporting mailbox or reporting service when aggregate reports are required.

Remediation procedure

  1. Correct malformed tags and ensure the record begins with v=DKIM1 where present.
  2. Publish one logical TXT value even if the DNS provider splits quoted strings.
  3. Remove unsupported duplicate tags.
  4. Test signatures generated by each mail platform.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, or provider values shown in your SecuTest evidence.

Inspect public DNS
dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short MX example.com

Inspect a DKIM selector
dig +short TXT selector._domainkey.example.com

Verify the fix

  1. Run: dig +short TXT selector._domainkey.example.com
  2. Decode and validate the p= value.
  3. Send a message and confirm dkim=pass.
  4. Repeat the SecuTest scan.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Copying surrounding quotes into the public-key value.
  • Publishing multiple conflicting records for one selector.
  • Confusing the selector hostname with the signing domain.

Authoritative references