Defaults.Exposed › October 2026 census › v10 registry › DKIM
DKIM
Methodology v10 · canonical ID dkim-exists · Email Security · scored
A cryptographic signature proving mail is genuinely from you; boosts deliverability.
DKIM: definition
| Canonical ID | dkim-exists |
|---|---|
| Category | Email Security |
| Grade impact | Scored, counts toward the grade |
| Pass | A DKIM (DomainKeys Identified Mail) public key is discoverable at a common selector under _domainkey.<domain>. |
| Fail | No DKIM selector is observable at the probed selectors. |
| Example (passing) | selector1._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBg…" |
DKIM across the census
50.5% of domains where a DKIM selector could be determined publish one (38,666,798 of 76,563,365, as of October 12, 2026).
The census probes a fixed list of common selectors, so a domain signing under an unguessed selector reads as not-determinable, never as absent. Treat this as a floor.
Aggregates only: never an individual domain's result.
How this check is scored
DKIM is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the October 2026 census, 255,928,954 of the 332,492,319 graded domains had no determinable result for this check: DKIM is evaluated only where the domain has MX (Mail Exchange) records and a recognised mail provider. Selectors cannot be listed from DNS (Domain Name System), so for every other domain the result is undetermined.
Every outcome in the census
| Outcome | Domains | Share of domains where a DKIM selector could be determined | In the headline figure |
|---|---|---|---|
| DKIM key found at a probed selector | 38,666,798 | 50.5% | Yes |
| No key at any probed selector | 37,896,567 | 49.5% | No |
Source: the October 2026 census rollup, deduplicated per domain, as of October 12, 2026.
By top-level domain
This splits the share of domains where a DKIM selector could be determined that publish one by TLD, with generic and country-code TLDs kept apart. A TLD is named below only when at least 100,000 of its domains are in this check's base.
| Kind | Combined share | Highest | Lowest |
|---|---|---|---|
| Generic TLDs (gTLDs): 353 TLDs, 53,174,501 domains | 45.8% | .site 86.3%, .shop 79.6%, .xyz 76.9% | .net 42.3%, .biz 42.7%, .org 43.7% |
| Country-code TLDs (ccTLDs): 167 TLDs, 23,270,113 domains | 61.1% | .ir 99.4%, .ru 96.4%, .sk 90.8% | .us 33.5%, .in 36.7%, .au 38.6% |
The largest TLD in this base, .com, stands at 44.5% (18,660,940 of 41,904,220).
Kind follows the IANA (Internet Assigned Numbers Authority) delegation type: every two-letter TLD is a ccTLD. The per-TLD rollup covers 76,444,614 of the 76,563,365 domains in this base. Grade shares for every TLD are on TLDs compared: the census section.
Against the other checks
Among the 7 Email Security checks with a published figure, DKIM has the 3rd highest pass share. Next above it is MX records: 54.3% of graded domains. Next below it is SPF (Sender Policy Framework) record: 46.3% of graded domains. Across every check with a published figure it ranks 12th of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix DKIM
DKIM setup walkthroughs for 8 providers: AWS Route 53, Beget, Cloudflare, GoDaddy, Google Workspace, Microsoft 365, Namecheap, REG.RU. All of them are on the DKIM setup walkthroughs by provider page.
Cite this check
Defaults.Exposed, "DKIM (dkim-exists)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/dkim-exists
Permalink: https://defaults.exposed/methodology/dkim-exists ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data