DKIM Key Revoked

Severity: Warning

What is DKIM?

DKIM (DomainKeys Identified Mail) is an email authentication method where the sending server digitally signs outgoing emails. The receiving server verifies the signature using a public key published in the sender's DNS. This proves the email hasn't been tampered with and genuinely came from the claimed domain.

What does a revoked key mean?

A DKIM record with an empty p= tag (like v=DKIM1; p=) is the standard way to revoke a DKIM key. According to the DKIM specification, an empty public key means the key has been explicitly revoked and should no longer be used for signature verification.

This is different from a missing or deleted DKIM record — a revoked key is an intentional signal that the key was once valid but has been deliberately deactivated.

Why this is a problem

When a DKIM key is revoked:

• Any emails signed with this selector will fail DKIM verification
• If this is the only active DKIM selector for your domain, no emails will pass DKIM checks
• DMARC policies that rely on DKIM alignment may cause emails to be rejected
• It may indicate a key rotation that wasn't completed — the old key was revoked but the new key isn't being used yet

What you should do

• If the key was intentionally revoked as part of a key rotation, verify the new key is active and your mail server is using the new selector
• If the revocation was unintentional, generate a new DKIM key pair and publish the public key
• Remove the revoked DKIM record from DNS if it's no longer needed to keep your DNS clean
• Ensure your mail server configuration references the correct, active DKIM selector
• Test email delivery after making changes to confirm DKIM signatures are passing