Why does G-Suite Check MX toolbox say DKIM is not set up when email headers show DKIM and SPF pass?
Summary
What email marketers say12Marketer opinions
Email marketer from StackExchange explains that MXToolbox sometimes caches old DNS records, leading to inaccurate results. Try clearing your browser cache or using a different browser to see if the issue persists.
Email marketer from Reddit suggests that DNS propagation delays could be the reason. It can take up to 48 hours for DNS changes to fully propagate across the internet, so the MXToolbox might be checking before the changes are fully visible.
Email marketer from DNSimple Blog shares that G-Suite requires specific DNS configurations, including SPF, DKIM, and DMARC. It’s important to follow Google’s official setup guides to ensure that all the necessary records are correctly configured.
Email marketer from Email Provider Forum suggests that the email might be signed with multiple DKIM keys, one from your domain and one from your email service provider (ESP). MXToolbox might only be checking for your domain's key.
Email marketer from Sparkpost states that an incorrect DKIM selector might be used in DNS records. The selector is a name for the DKIM record, so make sure you’re using the same selector that you specified when you set up DKIM.
Email marketer from StackOverflow mentions to ensure that the DNS record is being queried from the correct location to avoid discrepancies between the record's actual existence and results shown on a toolbox.
Email marketer from Mailhardener Blog explains that incorrect DKIM selector name used in DNS records can cause the records to fail validation on external validation sites.
Email marketer from EmailonAcid explains DNS Syntax errors can cause issues, so ensure there are no syntax errors such as extra spaces, missing quotes, and so on. It would also be ideal to use a DNS record checker to see if it helps find issues.
Email marketer from Google Groups mentions to check if the domain being tested in MXToolbox is the exact same domain that's being used to send the emails. A slight typo can lead to incorrect results.
Email marketer from Email Geeks suggests paying attention to the differences in the domain name of the DKIM = PASS, as it may be the same with SPF.
Email marketer from Mailjet mentions to check whether the DNS records are properly entered. When setting up SPF and DKIM, you’ll need to update your domain’s DNS records. Make sure that the values you have copied in the tool match the ones in your DNS records.
Email marketer from Email Geeks explains that you are missing SPF records on your sending domain. Not that it is needed if you do not use it as "returnpath" address but, it is still advised.
What the experts say4Expert opinions
Expert from Word to the Wise explains that different checkers use different underlying code and query from different locations, which can sometimes lead to inconsistencies in the results they display. It's possible the MX Toolbox is experiencing a temporary glitch or is querying a DNS server that hasn't yet updated.
Expert from Email Geeks explains if you plan on sending from Google with that domain, you need to add them to your SPF record. The current record is `<http://comms.uwe.ac.uk|comms.uwe.ac.uk>. 3600 IN TXT "v=spf1 include:<http://spf.dotmailer.com|spf.dotmailer.com> -all"`
Expert from Email Geeks explains that some ESPs sign with a key belonging to them and one belonging to your brand. It's possible the branded key doesn't exist.
Expert from Email Geeks believes the MX Toolbox might be wrong or the wrong test was selected, as the key appears functional and a manual lookup confirms it's fine.
What the documentation says3Technical articles
Documentation from RFC6376 explains the precise format of a DKIM signature in the email header. You can manually inspect the 'd=' (domain) and 's=' (selector) tags to ensure they match your DKIM record.
Documentation from DKIM.org explains that you can use command-line tools like `dig` or `nslookup` to manually query the DNS records and verify the DKIM configuration. This can bypass any potential issues with online testing tools.
Documentation from Google Workspace Admin Help explains the complete DKIM setup process for Google Workspace, which includes generating a DKIM key, adding the TXT record to your domain's DNS, and enabling DKIM signing in the Google Workspace admin console.