DKIM=none Explained: What It Means & How To Fix It

Key Takeaways

The “DKIM none message not signed” error occurs when emails lack a valid DKIM signature, often due to configuration issues or missing records.
Enabling DKIM in your email service settings ensures outgoing emails are properly signed and protected from tampering.
Generating and publishing accurate DKIM TXT records in your DNS is essential for effective email authentication.
Misconfigured DNS or syntax errors in the DKIM record are common causes of authentication failures and should be addressed promptly.
Regularly verify DKIM functionality by checking email headers for pass or fail results to ensure your setup is working correctly.

What Does DKIM=none Mean?

dkim=none in an Authentication-Results header means the receiving mail server found no DKIM signature at all on the message. It is not a failed check, it is the absence of one. The message either was never signed, or the signature was stripped in transit.

Here is how the header line appears in an inbox:

Authentication-Results: mx.google.com; dkim=none (message not signed) [email protected];

dkim=none: Indicates the absence of the signature.
(message not signed): This parenthetical is the reason string, explicitly stating that no signature was present, as opposed to a signature that existed and failed verification.
[email protected]: Shows the domain that was expected to be evaluated.

This result is defined in RFC 7601 (for the Authentication-Results header) and RFC 6376 (the DKIM specification). You can also paste your headers into an email header analyzer to spot this quickly.

DKIM=none vs. DKIM=fail vs. DKIM=neutral

Distinguishing between these three results is crucial because they point to entirely different problems in your authentication setup.

Result	Meaning	Signature present	Typical cause
dkim=none	No signature found	No	DKIM not enabled, or no record published
dkim=fail	Signature present but did not verify	Yes	Key mismatch, body altered in transit. See why DKIM fails
dkim=neutral	Signature present but unverifiable	Yes	Malformed signature or record syntax error

Is DKIM=none a Problem?

Is seeing dkim=none on a message a problem? The honest answer depends on the direction of the email.

If you see dkim=none on a single inbound message from a third party, it is not necessarily your problem. It simply means their system is not signing mail.

However, it is a major problem when it appears on your own outbound mail. This means your messages are unsigned and will fail DMARC unless SPF passes and aligns. Because DMARC requires at least one of SPF or DKIM to pass and align, unsigned mail relying on SPF alone breaks the moment a message is forwarded.

To check your current setup, run your domain through a DKIM record lookup tool and learn more about DKIM and DMARC alignment to ensure your outbound emails stay protected.

Possible Reasons for “DKIM none message not signed” and How to Fix Them

If you’ve never turned DKIM on for this domain, start with the first fix as it accounts for most cases.

DKIM Not Enabled in Email Settings

To perform cryptography-based authentication checks, you need to enable DKIM in email settings. This way, the domain will attach special headers with every email sent from your domain containing a private key. This key will be matched with the publicly available key to verify the senders’ authenticity. This also ensures that no malicious entity tampered with the email content.

Enabling DKIM in Gmail or Google Workspace

Here’s how you can enable DKIM in email settings in your Google Admin Console:

Generate DKIM record.
Add the TXT record name & DKIM key to your domain.
Sign in to your Google Admin Console and go to Menu > Apps > Google Workspace > Gmail.
Click on Authenticate email.
Go to the Selected Domain menu and select the domain for which you want to enable DKIM.
Click on the Start authentication button. Wait for a while, your DKIM setup will get completed, and the status at the top of the page will read – Authenticating email with DKIM.

Enabling DKIM in Microsoft Office 365

Here’s how you can enable DKIM in email settings for Microsoft Office 365:

First, sign in to Office 365 portal.
Go to the app launcher icon in the upper-left corner and click Admin.
See the lower-left navigation bar, go to Admin, and choose Exchange.
Go to Protection and click on DKIM.
Choose the domain for which you want to enable DKIM, followed by choosing Enable to allow signing messages for the chosen domain with DKIM signatures. Follow the same steps to enable DKIM for each custom domain.

Missing DKIM Record

When you come across the “No DKIM record found” error, it means your domain has failed to configure to DKIM email authentication standards. To get rid of this prompt, you need to configure DKIM for your domain by publishing a DNS TXT record using our DKIM record generator that can instantly produce a record with the correct syntax. Here’s what you need to do:

Choose your DKIM selector (e.g., selector1)
Type or paste your domain name (e.g. exampledomain.com).
Next, click on Generate DKIM record.
You will receive a private key that you need to enter in your DKIM signer.
Next, you will receive the generated DKIM record with your public key.

DKIM Configuration Errors

Syntactical and configuration errors in your DKIM record cause DKIM failures. You can set your record by following these steps:

Choose a DKIM Selector.
Generate a pair of public and private DKIM keys.
Use a DKIM TXT record to publish a selector and publish the public key.
Tokenize all the outbound emails for your domain.
Ensure that the DKIM public key record is correctly published in the DNS. It’s suggested to copy-paste it instead of manually typing it, as it’s a combination of numbers, special characters, and both uppercase and lowercase letters.

Other than this, to prevent a “DKIM none message not signed” error, you must avert the practice of widespread key sharing, as a simplified and sorted configuration of shared keys is a vulnerability that hackers can take advantage of. Also, validate the header of all outgoing emails; it should look like the following: dkim none message not signed.

DNS Not Hosted Locally

It’s advised to host DNS locally to have better control over your network and for proper DKIM configuration. It also enables you to centralize DKIM settings across the network stack. Follow these steps to fix it:

Get a static IP address of your domain.
Install DNS server software. A few options available are BIND, Microsoft DNS, and dnsmasq.
Configure the DNS server software with the appropriate settings, such as the domain name you want to use and any subdomains or zones you want to create.
Create DNS records for your domain and subdomains, such as A records for IP addresses and MX records for email servers. If everything is working correctly, you can update the DNS settings on your domain registrar’s website to point to your home DNS server.

How to Confirm DKIM Is Now Signing

Once you have applied the fixes, you need to confirm that your outbound messages are actually carrying a valid signature. Here are three ways to check:

Send a test message and read the header: Send an email from your domain to an external address (like a personal Gmail account). Open the email, select “Show original,” and look for the Authentication-Results header. You want to see dkim=pass instead of dkim=none. Alternatively, use our Email Header Analyzer to get instant insights.
Use a lookup tool: Run your domain and selector through our DKIM record lookup to instantly confirm that your public key is accurately resolving in DNS.
Allow for propagation lag: DNS changes are not always instant. A newly published DKIM record can take up to 48 hours to fully propagate across global networks. If you see dkim=none immediately after publishing your record, this is expected behavior and not a sign that your fix failed.

Fix “DKIM none message not signed” with PowerDMARC!

Choose a DKIM Selector.
Generate a pair of public and private DKIM keys.
Use DKIM TXT record to publish a selector and publish the public key.
Tokenize all the outbound emails for your domain.

Frequently Asked Questions

What does dkim=none mean?

It means the receiving mail server did not find a DKIM signature on the message. The email was either sent without being signed by the originating server, or the signature was removed while the message was in transit.

What does “message not signed” mean in an email header?

This is the specific reason string explaining why a DKIM check resulted in “none.” It explicitly confirms that no signature was present on the email to be evaluated, differentiating it from a signature that was present but failed verification.

Is dkim=none bad?

It is bad if it appears on emails your organization sends, because it means your outgoing mail relies entirely on SPF for authentication. If an unsigned email is forwarded, it will fail DMARC. On inbound mail from others, it simply means they aren’t signing their messages.

What’s the difference between dkim=none and dkim=fail?

dkim=none means no signature was attached to the message. dkim=fail means a signature was present, but the receiving server could not verify it, usually because the keys did not match or the email content was altered in transit.

How long does it take for a new DKIM record to work?

Once you publish a new DKIM record to your DNS, it can take up to 48 hours to fully propagate across all global servers. It is normal to continue seeing dkim=none on test emails during this propagation window.

About
Latest Posts

Yunes Tarada

Domain & Email Security Expert at PowerDMARC

Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.

DKIM=none: What It Means and How to Fix ‘Message Not Signed’