dkim.selector_resolvable Reviewed July 2026

Quick fix

Confirm the active selector in outbound message DKIM-Signature headers.

What this finding means

SecuTest tests only bounded, known, configured, common, or provider-inferred selectors. A failed candidate does not prove that the domain never signs mail; the finding applies to the selector represented in the evidence.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, or business intent when those cannot be proven remotely.

Why it matters

Security impact A configured selector that does not resolve prevents recipients from retrieving the public key needed to verify DKIM signatures.

Step-by-step fix

Where to make the change

  • The authoritative DNS zone for the domain.
  • The outbound mail platform or email-security gateway when signing or sender authorization is involved.
  • The DMARC reporting mailbox or reporting service when aggregate reports are required.

Remediation procedure

  1. Confirm the active selector in outbound message DKIM-Signature headers.
  2. Publish the TXT record or correct the CNAME target at selector._domainkey.example.com.
  3. Remove retired selectors from sender configuration.
  4. Allow DNS propagation before rotating traffic.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, or provider values shown in your SecuTest evidence.

Inspect public DNS
dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short MX example.com

Inspect a DKIM selector
dig +short TXT selector._domainkey.example.com

Verify the fix

  1. Run: dig +short TXT selector._domainkey.example.com
  2. Send a signed message and inspect Authentication-Results.
  3. Confirm the selector in the header matches the published key.
  4. Repeat the SecuTest scan using the explicit selector configuration when needed.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Treating an undiscovered selector as proof DKIM is absent.
  • Publishing the key at the root domain.
  • Switching senders before the new selector propagates.

Authoritative references