dkim.duplicate_records Reviewed July 2026

Quick fix

Identify the single active key for the selector.

What this finding means

A selector should resolve to one effective DKIM key record. Multiple TXT values or conflicting CNAME/TXT publication can create non-deterministic behavior across resolvers and validators.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, or business intent when those cannot be proven remotely.

Why it matters

Security impact Multiple conflicting DKIM records for one selector can make key retrieval ambiguous and cause verification failures.

Step-by-step fix

Where to make the change

  • The authoritative DNS zone for the domain.
  • The outbound mail platform or email-security gateway when signing or sender authorization is involved.
  • The DMARC reporting mailbox or reporting service when aggregate reports are required.

Remediation procedure

  1. Identify the single active key for the selector.
  2. Remove obsolete or conflicting TXT values.
  3. Avoid publishing both a CNAME delegation and local TXT key for the same owner name.
  4. Coordinate changes with the signing platform.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, or provider values shown in your SecuTest evidence.

Inspect public DNS
dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short MX example.com

Inspect a DKIM selector
dig +short TXT selector._domainkey.example.com

Verify the fix

  1. Query the selector from multiple external resolvers.
  2. Confirm one effective DKIM record is returned.
  3. Send signed mail and verify consistent dkim=pass.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Treating DNS TXT string fragments as separate records.
  • Deleting the active value instead of the retired one.
  • Leaving provider CNAME delegation alongside a local key.

Authoritative references