EMAIL-002: DKIM Signing Enabled
- Platform
- Google Workspace
- Category
- Advanced Threat Protection
- Severity
- Critical
- Zero Trust pillar
- Applications & Workloads (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
DomainKeys Identified Mail (DKIM) signing must be enabled and valid for all domains. DKIM provides cryptographic proof that email content has not been tampered with in transit
Recommended value
DKIM signing enabled with valid key published for all domains
Remediation
Admin Console > Apps > Google Workspace > Gmail > Authenticate email > Generate DKIM key and publish DNS record for each domain
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- SI-8, SC-8
- CIS Benchmark
- 2.2
- CISA SCuBA
- GWS.GMAIL.2.1v1
- MITRE ATT&CK
- T1566.001, T1566.002