Selected DKIM record declares an unsupported key type
ShipReady found a plausible DKIM record at a supported selector whose parsed k= value was neither rsa nor ed25519.
Why it matters
The k= tag is a configuration signal for the selected DKIM record. Reviewing an unrecognised value helps prevent a malformed record from being mistaken for a fully verified signing configuration.
How ShipReady detects it
What it inspects
ShipReady identifies a recognised SPF provider fragment, queries only that provider's fixed supported selectors, and parses the first plausible DKIM TXT record it finds.
What triggers a finding
The rule triggers when the lowercased parsed k= value is neither rsa nor ed25519. When k= is absent, ShipReady defaults it to rsa and does not trigger this rule.
What the evidence shows
The selected record's parsed k= value was outside ShipReady's supported rsa and ed25519 set.
Limits of this check
ShipReady does not validate the actual public key, verify that k= matches the key material, enumerate selectors, send email, test receiver parsing, or establish real-message authentication or deliverability outcomes.
How to fix it
Confirm the provider's active selector record
Identify the actual sending provider account and selector. The scanner's supported selectors are a bounded discovery set, not a complete account inventory.
Align the DNS record with provider instructions
If the selected record is active and unintended, publish the provider-supplied DKIM value or remove the invalid tag through the correct configuration workflow.
How to verify the change
Verify selector DNS and controlled mail
Query the actual selector after propagation and inspect DKIM authentication on controlled messages from the intended sender.
Expected: The intended record is published and controlled messages show the expected authentication result.