DIAGNOSTIC PLAYBOOK
DKIM key revoked: an empty p value
An empty p value in a DKIM key record indicates revocation. A receiver cannot use that record to validate signatures, even though a DNS lookup still finds a DKIM-shaped TXT value.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Inspect the complete TXT answer and confirm the key data is actually empty rather than truncated by the display.
- Check whether the selector was intentionally retired or affected by an incomplete DNS edit.
- If signing is still required, publish a valid provider-supplied key under the correct active selector and verify new traffic.
What this looks like
ILLUSTRATIVE EXAMPLE
A team clears the public-key value while retiring an old signer, but a scheduled job still uses that selector. The job's signatures stop validating.
A mistake to avoid
Do not undo a security-driven revocation casually. If the private key was compromised, rotate to a new key and retire the compromised signer.
Keep the result in context
A DKIM investigation needs a real signed message and the public key for its selector and signing domain. DNS alone cannot prove that a service is signing outgoing mail. Preserve the raw source when comparing messages so your own copy process does not change the bytes being checked.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.