← Back to the security guide
Email Spoofing ProtectionMedium risk
DKIM not detected
What does this mean?
DKIM adds a digital signature to outgoing email that proves it wasn't altered in transit and really came from your domain. We check for it using common default selectors — if your provider uses a custom one, DKIM may actually be configured and we simply couldn't detect it.
What are the potential impacts?
- Without a DKIM signature, there's no cryptographic proof that an email claiming to be from your domain wasn't altered in transit or forged outright.
- Combined with a weak or missing DMARC policy, this makes convincing spoofed email trivially easy to produce.
- Some mail providers weight DKIM heavily in spam and deliverability scoring, so missing it can also just mean your real marketing and transactional emails land in spam more often.
How to fix it
Check your email provider's admin settings for "email authentication" or "DKIM." Google Workspace, Microsoft 365, and most transactional email services (SendGrid, Postmark, etc.) all have a DKIM setup step, usually a one-time DNS record you add.
Want to see whether this actually affects your site? Run a free scan — no signup required.
Run a free scan