dkim.public_key_valid Reviewed July 2026

Quick fix

Export the public key again from the active mail platform.

What this finding means

SecuTest decodes the published RSA or Ed25519 public key and validates its structure. This is stronger than checking that `p=` is merely non-empty.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, compromise, or business intent when those cannot be proven remotely.

Associated attack or threat scenario

Threat type DKIM verification failure and authentication bypass opportunity

How the attack or failure scenario works

DKIM verification uses the DNS public key to check the cryptographic signature in the message. A malformed, truncated, or mismatched key causes verification failure. Attackers do not gain the private key, but the domain loses an authentication signal that helps receivers reject forged mail.

Conditions and limitations

  • A message uses the selector containing the invalid key.
  • The receiver cannot decode or use the key.
  • No other aligned authentication method satisfies DMARC.

Why it matters

Security and business impact An invalid DKIM public key cannot verify message signatures and can break DMARC for senders that rely on DKIM alignment.

Step-by-step fix

Where to make the change

  • The authoritative DNS zone for the registrable domain.
  • The outbound or inbound mail platform when sender authorization, signing, or routing is involved.
  • The DMARC reporting mailbox or reporting service when aggregate reports are required.

Remediation procedure

  1. Export the public key again from the active mail platform.
  2. Publish the complete base64 value without PEM wrappers or whitespace corruption.
  3. Confirm the key type declared in `k=` matches the generated key.
  4. Rotate to a new selector if the private/public key pair cannot be verified.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, provider, or policy values shown in your SecuTest evidence. Review every example before production use.

Extract RSA key
dig +short TXT selector._domainkey.example.com | tr -d '" '

Validate RSA public key
printf '%s' 'BASE64_PUBLIC_KEY' | base64 -d | openssl pkey -pubin -text -noout

Verify the fix

  1. Query the TXT record externally.
  2. Decode and inspect the key with OpenSSL or the provider validator.
  3. Send signed mail and confirm `dkim=pass`.
  4. Repeat SecuTest after the DNS update.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Publishing PEM header and footer text.
  • Truncating a long TXT value in the DNS control panel.
  • Declaring `k=ed25519` for an RSA key or the reverse.

Authoritative references