Check ID: zone_record_dkim_exists
Provider: Cloudflare
Service: zone
Severity: MEDIUM
Categories: email-security
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for DKIM (DomainKeys Identified Mail) records by checking if TXT records exist at *._domainkey subdomains containing a cryptographically valid public key in the p= parameter used to verify email signatures.

​
Risk

Without DKIM or with a revoked/empty public key, recipients cannot verify messages were sent by authorized servers. Attackers can forge emails from your domain, and content integrity cannot be proven. DMARC policies relying on DKIM will fail, affecting deliverability. A DKIM record with empty p= indicates a revoked key.

​
Recommendation

Configure DKIM records with valid public keys from your email provider.
  • Each email service requires its own DKIM selector (e.g., google._domainkey for Google Workspace)
  • The p= parameter must contain the actual public key, not be empty
  • An empty p= value indicates a revoked key and will fail this check
  • DKIM works alongside SPF and DMARC for comprehensive email authentication
  • Rotate DKIM keys periodically for enhanced security
  • Use 2048-bit keys for stronger cryptographic protection

​
Remediation

# Create DKIM record for email authentication
resource "cloudflare_record" "dkim" {
  zone_id = "<ZONE_ID>"
  name    = "google._domainkey"  # Selector varies by email provider
  type    = "TXT"
  content = "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4..." # Must contain valid public key
  ttl     = 3600
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_record_dkim_exists. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks