What happens if my domain has no DKIM record?
Your mail is not signed, so receiving servers cannot check that it came from you unchanged. It can still pass DMARC through SPF. Forwarded mail often fails SPF. Mail that fails both is more likely to land in spam, or be refused once your DMARC policy is reject.
Last read from the sources at the foot of this page.
What does it mean for a business?
DKIM attaches a signature that receiving servers check against a key in your DNS.
Assertion of responsibility is validated through a cryptographic signature and by querying the Signer's domain directly to retrieve the appropriate public key.
What happens without it?
The Canadian Cyber Centre says what a receiving server does.
If the signature is not valid, or if no DKIM record is available, the message will fail DKIM and may be rejected.
What should you do?
- Turn on DKIM in your email provider.It shows the record to publish.
- Publish that record in your DNS settings, exactly as shown.
- Turn on DKIM for each service that sends for you, such as newsletters or invoicing.
- Send a test and check the DKIM result in the message header.
Where is the change made?
Your DNS settings, for the DKIM record. Your email provider's admin settings, for the switch that starts signing.
What else do people ask about this?
Where do I find my DKIM record?
It sits at a name made of a selector and _domainkey, such as selector1._domainkey for Microsoft 365 or google._domainkey for Google Workspace.
Do I need DKIM if SPF passes?
Yes. SPF breaks when mail is forwarded. DKIM usually survives forwarding, so it keeps DMARC passing.
Where does this come from?
- RFC 6376, DomainKeys Identified Mail (DKIM) Signaturesrfc-editor.orgRead 16 October 2026
- Canadian Centre for Cyber Security, Implementation guidance: email domain protection (ITSP.40.065)cyber.gc.caRead 16 October 2026
See what is open before anyone else does.
We read your domain from outside and show each way in with a check anyone can re-run.