I'm trying to setup opendkim, but I get this result:

# opendkim-testkey  -vvvv -d my.example.com -s 201702
opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: checking key '201702._domainkey.my.example.com'
opendkim-testkey: key not secure
opendkim-testkey: key OK

That should mean DNSSEC is not working.

But according to https://dnssec-debugger.verisignlabs.com/example.com dnssec is fine.

Should I worry?

  • 1
    The TLD dom doesn't yet exist, so domain.dom wouldn't have DNSSEC. Your link doesn't state that DNSSEC is fine on domain.dom, rather that DNSSEC on the root zone is fine.
    – Torin
    Mar 27, 2018 at 15:51
  • 3
    It is obvious that my.domain.dom is an example,
    – Lenne
    Oct 29, 2018 at 0:41
  • 1
    And we cannot help you diagnose DNSSEC issues on a domain which isn't supplied.
    – Torin
    Oct 29, 2018 at 12:18

1 Answer 1


You have to make sure that OpenDKIM is able to use DNSSEC. key not secure in this context means that OpenDKIM was not able to verify the key using DNSSEC.

For example, you can use dig to see if it reports the AD (authentic data) flag:

$ dig yourselector._domainkey.yourdomain.org TXT +dnssec

; <<>> DiG 9.16.1-Ubuntu <<>> yourselector._domainkey.yourdomain.org TXT +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26731
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1


The important bit here is the flag ad: it means that whatever resolver was used on the host was able to authenticate the response data with DNSSEC.

For OpenDKIM, you also must make sure that it can use DNSSEC. For example, on Debian the setting TrustAnchorFile /usr/share/dns/root.key in the default /etc/opendkim.conf provides the support for DNSSEC capabilities.

  • 1
    This is the solution. @Lenne you might accept this answer...
    – 71GA
    Jan 4, 2021 at 21:09
  • 1
    Hi @Lenne , @71GA and @glts I know this answer was a long time ago, but i'm facing the same error as the OP and can't figure out why i'm getting it. dig command did not show me the ad flag, I added the TrustAnchorFile but things stayed the same, with or without it. Any more ideas ? Thanks a lot Feb 21 at 17:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .