DKIM
DKIM cryptographically signs outgoing mail so receivers can tell it was not altered in transit.
What the check looks at
Section titled “What the check looks at”SigHQ checks that DKIM keys are published in DNS. It does not look inside Exchange or Google. This catches the common case where DKIM is switched on in the admin console but the DNS records were never added.
Microsoft 365
Section titled “Microsoft 365”Microsoft uses two fixed selectors, selector1._domainkey and selector2._domainkey, published as CNAME records. For the full walkthrough, see Enable DKIM signing in Microsoft 365.
Google Workspace
Section titled “Google Workspace”Google’s default selector is google._domainkey. Workspace lets you choose a custom selector name, and SigHQ cannot discover it. So a correctly configured domain can show Unknown. To verify manually, find your selector in the Google Admin console under Gmail authentication and confirm that <selector>._domainkey.<yourdomain> resolves to a TXT record.
Fix it
Section titled “Fix it”Next: DMARC.