No plausible DKIM record was observed at supported provider selectors
ShipReady found no plausible DKIM TXT record at the fixed supported selectors associated with a recognised provider fragment in the selected SPF text.
Why it matters
DKIM records are published at provider-specific selectors. Reviewing the selectors used by an actual sending account helps an owner confirm that intended email-authentication configuration is present.
How ShipReady detects it
What it inspects
ShipReady examines the selected SPF text for a fixed set of recognised provider fragments. It does not enumerate DKIM selectors or infer a provider from arbitrary SPF content.
When a recognised provider fragment is present, ShipReady queries only that provider's fixed supported DKIM selector set at <selector>._domainkey.<organisational-domain>. A TXT value is treated as plausible when it begins with v=DKIM1 or contains p=.
What triggers a finding
The rule triggers only when every completed lookup in that supported selector set lacks a plausible DKIM record. A DNS lookup failure is inconclusive and suppresses the finding; absent SPF or an unrecognised provider fragment also suppresses the check.
What the evidence shows
No plausible DKIM record was observed at the supported selectors associated with the recognised SPF provider signal.
Limits of this check
The supported selector set is deliberately bounded and is not exhaustive. ShipReady does not prove that the domain has no DKIM, that other selectors do not exist, that outgoing messages are unsigned, that DKIM fails for real email, that forwarding fails, that inbox or spam placement is affected, or that overall email authentication is broken. ShipReady does not send email.
How to fix it
Confirm the actual sending provider
Identify the provider and account that send mail for the domain. Do not treat the recognised SPF provider fragment as a complete inventory of all sending systems.
Determine the account's real DKIM selectors
Use the provider's account configuration and deployment records to identify the selectors it actually uses. Do not assume ShipReady's supported selector set is exhaustive.
Verify the corresponding DNS records
Confirm the intended selector records are published at the provider-specified _domainkey names and correct any missing or stale records through the provider's documented setup process.
How to verify the change
Verify provider configuration and real mail separately
Check the provider account's configured selectors, query their DNS records after propagation, and inspect authentication results on controlled messages from each intended sender.
Expected: The actual provider selectors resolve as intended and controlled messages show the expected authentication results. ShipReady did not send these messages.