methodology / Security & Infrastructure / #2

DKIM signing

#2 · Recommended · Web Quality · weighted · Security & Infrastructure · weight 2% · impl implemented · method v1.2.0

Web Quality factor

This factor is part of Web Quality — the weighted 0..100 score that sits above Web Standards. Its weight depends on what kind of site is being measured. Web Standards items take priority; this factor only enters the score once Web Standards passes.

Base weight: 1.0 applied to every site type unless overridden below
Why this weight: DKIM signing is required infrastructure for any domain that sends mail. Personal sites usually don't run their own mail.

Per-site-type overrides

Site type	Weight	Δ vs base
Blog	0.5	-0.5
Personal site	0.4	-0.6

Site types not listed inherit the base weight.

Same factor, two depths.

What we measure

DKIM cryptographically signs your outgoing emails so recipients can verify they actually came from you. Without it, mail providers can't tell real from spoofed.

How to improve your score

Generate DKIM keys via your email provider (Google Workspace, Microsoft 365, Mailgun, etc.) and publish the public key as a TXT record at the selector your provider specifies.

Facts

Ticket

WEBQ-2

When this applies

DKIM is only graded for sites that send mail (branded domain email present).

Requires a passing result on factor(s): #75.

Scoring

Scoring formulas are versioned with the methodology. The current method (v1.2.0) maps raw measurements to pass, warn, fail. Factor weights determine how much each contributes to the composite — see the methodology index for the full table.

Cited by these standards

Standards in the Standards Library whose satisfiedBy requirement tree references this factor. Each link goes to the standard's full entry — methodology, scope, and the other factors it relies on.

Authenticated Received Chain (ARC) Email health global Preserves DKIM/SPF authentication results when mail is forwarded through mailing lists or alias services. The fix for `forwarder breakage`.
Bulk-sender requirements (Apple / Google / Yahoo) Email health global The de-facto standard for marketing mail since February 2024. SPF + DKIM + DMARC, RFC 8058 one-click unsubscribe, and a spam-complaint rate under 0.30%. Miss any of these and Gmail / Yahoo throttle or reject.
DKIM Email health global Cryptographically signs outbound mail so receivers can verify the sender wasn't spoofed mid-flight. The other half of DMARC.
DKIM key rotation Email health global DKIM keys aren't fire-and-forget. Rotate at least annually, retire old selectors, and use 2048-bit RSA. The mechanics are spelled out in RFC 6376 §3.1.

Version history

Version	Change	Date
v1.2.0	Factor introduced. Status: live. Scoring impl: implemented.	2026-04-25

← back to methodology