Selected DKIM record has no non-empty public-key value
ShipReady found a plausible DKIM TXT record at a supported selector, then parsed its p= value as empty or absent.
Why it matters
A DKIM public-key record should be reviewed when the selected record has no non-empty p= value. The scanner's result is limited to that DNS text condition; real mail authentication requires separate message-level verification.
How ShipReady detects it
What it inspects
ShipReady first identifies a recognised provider fragment in the selected SPF text, then queries only that provider's fixed supported DKIM selectors. It uses the first TXT value that begins with v=DKIM1 or contains p=.
What triggers a finding
The rule triggers when the selected plausible record's parsed p= value is empty. Because the parser defaults an absent p= tag to an empty value, an absent p= also triggers this rule.
What the evidence shows
The selected supported-selector record had no non-empty p= value under ShipReady's tag parser.
Limits of this check
ShipReady does not enumerate selectors, decode or validate a key, inspect all provider accounts, send email, inspect DKIM-Signature headers, or establish whether any real message passes or fails DKIM authentication. An absent p= tag is reported by this implementation but is not independently classified as an intentional revocation.
How to fix it
Confirm the provider account and selector
Identify the sending provider account and its actual active selectors before changing DNS. ShipReady's supported selector set is intentionally bounded.
Restore the intended DKIM record
If this record should support signing, publish the current provider-supplied non-empty public key at the actual selector, or remove stale selector references through the provider's documented rotation process.
How to verify the change
Verify DNS and controlled mail separately
Query the actual selector after propagation and inspect DKIM authentication results on controlled messages from the intended sender.
Expected: The active provider selector has the intended record and controlled mail shows the expected authentication result.