dkim.testing_flag Reviewed July 2026

Quick fix

Confirm all legitimate senders sign correctly with the selector.

What this finding means

The DKIM `t=y` flag marks a domain as testing. Receiver behavior varies, so SecuTest treats production use as a low-severity hardening issue rather than a guaranteed bypass.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, compromise, or business intent when those cannot be proven remotely.

Associated attack or threat scenario

Threat type Reduced trust in DKIM failures during testing

How the attack or failure scenario works

Some receivers may use the testing signal when deciding how much weight to give a failed signature. The flag does not automatically make a forged message pass, but it can weaken the operational intent of DKIM and create inconsistent treatment across providers.

Conditions and limitations

  • The selector publishes `t=y`.
  • A receiver chooses to alter handling based on the testing flag.
  • An attacker sends a message that would otherwise fail or lack trustworthy DKIM validation.

Why it matters

Security and business impact Leaving `t=y` enabled in production can signal that verification failures should be treated less strictly than intended.

Step-by-step fix

Where to make the change

  • The authoritative DNS zone for the registrable domain.
  • The outbound or inbound mail platform when sender authorization, signing, or routing is involved.
  • The DMARC reporting mailbox or reporting service when aggregate reports are required.

Remediation procedure

  1. Confirm all legitimate senders sign correctly with the selector.
  2. Remove only the `y` testing flag from the production record.
  3. Preserve any intentionally required flag such as strict identity behavior.
  4. Monitor DMARC reports and delivery after the change.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, provider, or policy values shown in your SecuTest evidence. Review every example before production use.

Production record
v=DKIM1; k=rsa; p=BASE64_PUBLIC_KEY

Inspect flags
dig +short TXT selector._domainkey.example.com

Verify the fix

  1. Query the selector and inspect the `t=` tag.
  2. Send external test messages and confirm `dkim=pass`.
  3. Verify the testing flag is absent from all active production selectors.
  4. Repeat the scan.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Removing the entire `t=` tag when another required flag is present.
  • Ending testing before all sending platforms are migrated.
  • Assuming every receiver interprets `t=y` identically.

Authoritative references