dkim.public_key_valid Reviewed July 2026

Quick fix

Export the public key again from the active mail platform.

What this finding means

SecuTest decodes the published RSA or Ed25519 public key and validates its structure. This is stronger than checking that p= is merely non-empty.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, or business intent when those cannot be proven remotely.

Why it matters

Security impact An invalid DKIM key cannot be used by receivers to verify message signatures.

Step-by-step fix

Where to make the change

  • The authoritative DNS zone for the domain.
  • The outbound mail platform or email-security gateway when signing or sender authorization is involved.
  • The DMARC reporting mailbox or reporting service when aggregate reports are required.

Remediation procedure

  1. Export the public key again from the active mail platform.
  2. Publish the complete base64 value without PEM headers or whitespace corruption.
  3. Confirm the key type matches k=.
  4. Rotate the selector if the private/public pair cannot be verified.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, or provider values shown in your SecuTest evidence.

Inspect public DNS
dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short MX example.com

Inspect a DKIM selector
dig +short TXT selector._domainkey.example.com

Verify the fix

  1. Query the TXT record externally.
  2. Decode the key with OpenSSL or the provider's DKIM validator.
  3. Send a message and verify dkim=pass.
  4. Repeat the SecuTest scan.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Publishing -----BEGIN PUBLIC KEY----- wrappers.
  • Truncating long TXT values.
  • Mismatching RSA and Ed25519 key declarations.

Authoritative references