Why does Lockpick report DKIM as not tested?

DKIM is always reported as not tested. Checking it needs the selector name your email provider chose and a signed message, and a scan never guesses selectors or sends mail.

What does this check look at?

DKIM needs a selector name and a signed message, so the scan reports it as not tested instead of guessing selectors. Cloudflare explains that email servers use the DKIM selector provided by the email service provider, not just the domain name. DKIM adds a signature to every message, so a mail server can tell it really came from you and wasn’t changed on the way.

Pulse and Deep scans both run it. It reads public records about your domain and never touches your site.

What does a result mean?

Not tested means unknown, never that DKIM is missing or working.

How serious is a finding?

This is information only. It claims no weakness, so it carries no verdict, and you decide whether anything should change. Confidence starts at medium, because it rests on public records rather than a response from your site. The report lists what to fix by how directly someone could use it, not by the severity label.

Which standards does it relate to?

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

Fix it with your AI

Your email provider turns DKIM on. This prompt walks you through confirming it.

Help me confirm DKIM signing for my domain. Ask me which email provider and which other tools send mail as my domain. For each one, tell me where in its settings DKIM is turned on, which DNS records it asks me to add, and how to check a message I send has a passing dkim= result in its headers.

How to check

Say Atlas, our example app at atlas.example, sends mail through a workspace provider. Its DKIM setup lives in the provider admin panel, and a sent message header shows whether signing works.

Run a Pulse scan from your Lockpick account to see it for your site. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.