What is it?
This finding means DKIM cannot be verified from the domain name alone. A DKIM check needs either a real received message with a DKIM-Signature header or a specific selector to query in DNS.
Why does it matter?
Mail platforms choose their own DKIM selectors, and a domain can publish many selector records. Guessing selectors can produce false failures. A domain-only check can say whether common records exist, but it cannot prove that outbound mail is signed correctly.
How to fix it?
Use the mail test and send a real message to the generated address, or provide the selector used by your mail platform if you are testing DNS manually.
selector1._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=..."Check the sending platform documentation for the exact selector name, publish the TXT record, wait for DNS propagation, and send a new message to verify the result.