Why the health check can't guarantee full DKIM coverage

Unlike an MX or SPF record, there is no DNS mechanism to ask "what DKIM selectors does this domain use?" — a selector only becomes discoverable once you've seen it in a signed message or been told about it directly. This tool's DKIM-selector health check therefore probes the union of healthcheck.dkim_selectors (configured) and selectors already observed in that domain's ingested reports — a growing but never provably complete list.

A fail or missing result here means a specific known selector has a problem, not that DKIM is broken domain-wide; a clean result means "every selector we know about checks out," not "DKIM is fully configured."