# Why does Lockpick report DKIM as not tested?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

DKIM needs a selector and a signed message to verify, so a scan reports it as not tested instead of guessing. Here is how to check it yourself.

DKIM is always reported as not tested. Checking it needs the selector name your email provider chose and a signed message, and a scan never guesses selectors or sends mail.

## What does this check look at?

DKIM needs a selector name and a signed message, so the scan reports it as not tested instead of guessing selectors. Cloudflare explains that email servers use the DKIM selector provided by the email service provider, not just the domain name. DKIM adds a signature to every message, so a mail server can tell it really came from you and wasn’t changed on the way.

Pulse and Deep scans both run it. It reads public records about your domain and never touches your site.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| Not tested | DKIM was not checked, by design. | Confirm it in your email provider, or read the headers of a message you sent. |

Not tested means unknown, never that DKIM is missing or working.

## How serious is a finding?

This is information only. It claims no weakness, so it carries no verdict, and you decide whether anything should change. Confidence starts at medium, because it rests on public records rather than a response from your site. The report lists what to fix by how directly someone could use it, not by the severity label.

## Which standards does it relate to?

| Standard | Reference |
| --- | --- |
| OWASP Top Ten | `A02:2025` Security Misconfiguration |
| CWE | `CWE-345` |

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

## Fix it with your AI

Your email provider turns DKIM on. This prompt walks you through confirming it.

:::fix-prompt any
Help me confirm DKIM signing for my domain. Ask me which email provider and which other tools send mail as my domain. For each one, tell me where in its settings DKIM is turned on, which DNS records it asks me to add, and how to check a message I send has a passing dkim= result in its headers.
:::

## How to check

Say Atlas, our example app at `atlas.example`, sends mail through a workspace provider. Its DKIM setup lives in the provider admin panel, and a sent message header shows whether signing works.

Run a Pulse scan from your Lockpick account to see it for your site. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains what each scan reads, and the [full list of checks](/checks) shows the rest.

## Questions people ask

### Does not tested mean DKIM is missing?

No. It means unknown. The scan does not know your selector name, so it cannot look the record up without guessing.

### Can I find my selector myself?

Yes. Open a message you sent, view its original headers and look at the DKIM-Signature line. The s= value is the selector.

## Sources

- [Email anyone can send](https://www.lockpick.app/docs/learn/email-anyone-can-send), Lockpick docs, read on 2026-10-07
- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07
- [What is a DNS DKIM record?](https://www.cloudflare.com/learning/dns/dns-records/dns-dkim-record/), Cloudflare Learning Center, read on 2026-10-07