dkim.testing_flag Reviewed July 2026

Quick fix

Confirm all legitimate senders sign correctly with the selector.

What this finding means

The t=y flag marks a domain as testing DKIM. Receiver behavior varies, so production domains should remove it after rollout validation unless a documented transition requires it.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, or business intent when those cannot be proven remotely.

Why it matters

Security impact Leaving the DKIM testing flag enabled can signal that verification failures should be treated less strictly than intended.

Step-by-step fix

Where to make the change

  • The authoritative DNS zone for the domain.
  • The outbound mail platform or email-security gateway when signing or sender authorization is involved.
  • The DMARC reporting mailbox or reporting service when aggregate reports are required.

Remediation procedure

  1. Confirm all legitimate senders sign correctly with the selector.
  2. Remove t=y from the production key record.
  3. Keep any other required flags, such as strict identity restrictions, deliberately.
  4. Monitor DMARC reports after the change.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, or provider values shown in your SecuTest evidence.

Inspect public DNS
dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short MX example.com

Inspect a DKIM selector
dig +short TXT selector._domainkey.example.com

Verify the fix

  1. Run: dig +short TXT selector._domainkey.example.com
  2. Confirm the t= tag no longer contains y.
  3. Send external test messages and verify dkim=pass.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Removing the entire t= tag when another required flag is present.
  • Ending testing before all sending platforms are migrated.
  • Assuming every receiver interprets t=y identically.

Authoritative references