DKIM record with empty p= — a revoked key still in use
RFC 6376 §3.6.1 defines a DKIM record with an empty p= tag as an explicit revocation. Receivers treat signatures made with that key as failures, not as unsigned.
This usually appears when a key is rotated and the old selector is emptied rather than deleted, while some system is still signing with it.
How to fix it
- 1Identify which system still signs with the revoked selector by reading the s= tag in a recent message.
- 2Point that system at the current selector, or complete the key rotation.
- 3Delete the revoked record once nothing signs with it.
Check whether your domain has this problem
Free, no signup, about two seconds. You get the exact record to paste.
Related guides
- SPF include points at a domain with no SPF record — a silent PermError
- DMARC record syntax errors that make receivers skip your policy
- DMARC external destination not authorized — why you receive no reports
- Two DMARC records at _dmarc — why your policy is being ignored
- Multiple SPF records on one domain (PermError) — how to merge them