DKIM not set up: why this is the gap throws a wrench into small-business email

DKIM not set up means your domain never published the public key receivers use to prove a message really came from you and wasn’t changed in transit. When that key is missing, Gmail and Outlook have no signed proof they can check, so quotes, form replies, and booking confirmations get filtered or rejected even though you sent them honestly. Bummer…

That gap is the single most common one we see. In our scan of 4,673 small businesses across the US and Canada, 51.1% were missing DKIM on any of the usual places to look. SPF gaps hit about one in five whereas DKIM is the majority problem. And it’s not complicated to set up, so I wonder why it’s not being properly handled.

The stamp your customers never see

Think of SPF as the guest list at the door: which servers are allowed to send in your name. DKIM is the wax seal on the letter itself. The receiving inbox checks a signature attached to the message against a public key your domain publishes. If the seal matches, the message is intact and tied to you, but if there is no seal to check, the inbox is guessing, and guessing now usually means spam or a hard reject.

You never see that stamp in your outbox and your customer never sees it either. The only place it shows up is in the technical check the receiving side runs before deciding whether to trust you. So a business can send mail for months, watch it “send fine” from their own tools, and still be failing the check that matters.

It’s only when you get a phone call asking why you haven’t sent the email that you figure out something’s probably gone awry.

What a real DKIM record looks like

The public key sits in DNS under a name that starts with a short label (the “selector”), then _domainkey, then your domain. Here is GitHub’s, published today at google._domainkey.github.com:

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...

In plain English: this is a DKIM key (v=DKIM1), it uses RSA (k=rsa), and everything after p= is the public half of the key. The private half stays on the mail server that signs outgoing messages. When a message arrives claiming to be from github.com, the receiver looks up that public key and verifies the signature. No matching key in DNS means there is nothing to verify.

Your domain either publishes a line like this under one of the common selector names, or it doesn’t. “DKIM not set up” is the second case.

Set up vs not set up

	DKIM set up	DKIM not set up
What DNS shows	A public key under something._domainkey.yourdomain	No usable key on the usual selectors
What the inbox can prove	The message was signed by your domain and not tampered with	No signed proof tied to your domain
Typical outcome since 2024–2025	Clears one of the main trust checks	Extra scrutiny, spam folder, or outright rejection
How common in our study	Minority of firms	51.1% of 4,673 firms

That 51% figure lines up with larger research: Wang and colleagues (USENIX Security 2022) found only about 37% of mail-receiving domains in the Alexa Top 1 million had DKIM at all. Small local businesses are not uniquely broken; they sit in the same global gap, just with more at stake when a single lead disappears.

Why this one stays unfinished

SPF is one line people sometimes copy when they buy a domain. DKIM takes an extra step from each sending tool: Google Workspace, Microsoft 365, Mailchimp, a form plugin, a booking system. Each one generates its own selector and key. Skip the paste into DNS, and that tool’s mail leaves unsigned while the messages you type by hand still look fine.

The plain-English guide covers how SPF, DKIM, and DMARC fit together. The short version for owners: if only one check is red, it is most often this one. Real estate firms were the worst industry we measured overall, and the same DKIM gap shows up across trades, clinics, and online stores.

How to tell without guessing

Do not trust a “send test email” button, and do not trust emailing yourself. Those only prove a message left your system or reached the friendliest inbox you have. You need to see whether a public key exists for your domain the same way a stranger’s inbox would look it up.

Run your domain through the free scanner. It checks the common selector names and tells you in plain English whether DKIM showed up. Green means a key was found. Red means it wasn’t, and that is the first record to finish.

Common questions

If SPF is already set up, do I still need DKIM? Yes. Receivers treat them as separate proofs: SPF says which servers may send, and DKIM says this exact message was signed by your domain and wasn’t altered. One without the other is still an incomplete setup.

Can I add DKIM myself? Usually yes, and it costs nothing. Your email or marketing provider shows you a name and a public key; you paste that as a text record in your domain settings. The hard part is knowing which of your tools need their own key, which is why starting with a scan helps.

I emailed myself and it arrived. Doesn’t that mean DKIM is fine? No. Your own inbox is the friendliest place your mail will ever land. That test can pass while a customer’s Gmail or Outlook still has no signed proof the message is really yours.

Is missing DKIM the same as being hacked? No. It almost always means the signing step was never finished when you set up email, a website form, or a marketing tool. Close the gap so honest mail can prove itself.