Skip to content
Webmaster Tools
EmailEmail Deliverabilitydkim=none

dkim=none

What dkim=none in an Authentication-Results header means, why your mail arrives without a DKIM signature, and how to turn on signing with your provider.

What dkim=none means

dkim=none means the message carried no DKIM signature that the receiver could evaluate. There is no DKIM-Signature header, so there is nothing to verify. It is different from dkim=fail, where a signature exists but doesn't verify. Without DKIM, DMARC can only pass through aligned SPF, which breaks as soon as a message is forwarded.

Authentication-Results: mx.google.com;
       dkim=none;
       spf=pass smtp.mailfrom=example.com;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=example.com

Some receivers write dkim=none (message not signed). Gmail and Yahoo expect bulk senders to sign with DKIM (sender requirements), and many filters score unsigned mail lower. You can read your own message's results in the Email Header Analyzer.

Why mail goes out unsigned

  • DKIM was never turned on. Some providers sign with their own domain by default; others don't sign at all until you set it up.
  • Records added, signing not started. In some admin consoles you publish the DNS record and then have to start signing separately.
  • A different route. Mail from a web server, a printer, a CRM or a contact form plugin goes out through a server that doesn't sign, while your mailbox mail is signed.
  • Your own mail server has no signing milter configured, or the milter only signs for domains listed in its signing table.

Turning it on

The private key stays with the sender. You publish the public key in DNS at selector._domainkey.example.com, as a TXT record or as a CNAME to a record the provider hosts:

s1._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...IDAQAB"
Sender Where to set it up Typical DNS
Google Workspace Admin console, Gmail, Authenticate email TXT at google._domainkey
Microsoft 365 Defender portal, DKIM settings CNAMEs at selector1._domainkey and selector2._domainkey
Email platforms "Domain authentication" or "sender domain" One or more CNAMEs
Own server OpenDKIM, Rspamd or similar TXT with your own key

Menu names change over time; follow your provider's current documentation for the exact steps. Use 2048-bit RSA keys where the provider and your DNS host support them.

On your own Postfix server with OpenDKIM, signing is a milter:

# /etc/postfix/main.cf
smtpd_milters = inet:localhost:8891
non_smtpd_milters = $smtpd_milters
milter_default_action = accept

with the domain and selector listed in OpenDKIM's SigningTable and KeyTable.

Check after the change

Send a test message to a mailbox you can read and look for:

dkim=pass header.i=@example.com header.s=s1

The header.i (or header.d) domain should be your own, or at least share your organizational domain, so that DKIM aligns for DMARC. A pass for the provider's domain doesn't help DMARC; see DMARC alignment.

Check whether a selector publishes a key with the Email Checker, replacing the selector with yours.