Email deliverability
How to set up DKIM
What 13x checks
This is rule deliverability.dkim in the public registry: A DKIM key is discoverable. It runs on every audit, against the pages we actually fetched, and its result is derived from the response rather than estimated.
- Surface
- Email deliverability
- Score weight
- 6 of the readiness score
- Scope
- Runs on every audited page
- Applies
- Only where the market or the page shape makes it relevant
Registry version 2026-07-30. Every rule is published, and the audit is deterministic — the same page produces the same finding every time.
The fix
The same text the audit hands you when this check fails on your own site.
DKIM is published by your sending provider, not written by hand — they generate the key pair and give you a record to add.
Where to find it:
| Provider | Where | | --- | --- | | Google Workspace | Admin → Apps → Gmail → Authenticate email | | Microsoft 365 | Defender → Policies → Email authentication → DKIM | | Resend | Domains → your domain → DNS records | | SendGrid | Settings → Sender Authentication → Domain | | Postmark | Servers → Signatures → DKIM |
You will get either a TXT record at <selector>._domainkey.example.com, or CNAMEs pointing at the provider — the CNAME form is preferable because they can rotate the key without you touching DNS.
On this check specifically: DNS gives no way to list the records under a name, so we can only look up common selectors. If yours is custom, your setup may be correct and simply invisible here. Confirm by sending yourself a message and checking for a DKIM-Signature header with dkim=pass in the Authentication-Results.
Does your site have this problem?
13x checks this and 112 others against your live URL in about 30 seconds. No account, and every finding comes with the fix for your framework.
No signup. Results in 30 seconds.