dkim=none

dkim=none means the receiver found no DKIM signature on the message, so it had nothing to verify. No signing domain took responsibility for the message, and nothing protects its content from changes along the way.

What the RFC says

RFC 8601 §2.7.1 defines none in five words: the message was not signed. RFC 6376 §6.3 asks receivers not to reject mail just for lacking a signature, because unsigned mail is still common. It also notes that unsigned mail has no verified identity to attach trust or reputation to.

From: "Front Desk" <frontdesk@example.org>
Authentication-Results: mx.example.net;
       spf=pass smtp.mailfrom=example.org;
       dkim=none (message not signed);
       dmarc=pass header.from=example.org

Who sends unsigned mail

• Small domains on basic hosting. A web host's mail server, or an old on-premises server, that nobody configured to sign.
• Devices and scripts. Scanners, printers, monitoring alerts, cron jobs and web forms that send directly through SMTP.
• A provider that signs with its own domain only until you set up yours. In that case you would see dkim=pass for the provider's domain, not none. A true none means nobody signed at all. The analyser explains every DKIM-Signature it finds, so you can check.
• Rarely, a header stripped in transit. Some gateways remove or rewrite headers. If the copy you have does contain a DKIM-Signature but the receiver reported none, the signature was probably added after the receiver checked it, or the receiver ignored it.

What it means for DMARC

DMARC needs either an aligned DKIM pass or an aligned SPF pass (RFC 9989 §4.4.1, §5.3.5). Without DKIM, SPF is the only route, and SPF breaks on forwarding. That is why the message above passes DMARC today but would fail if the recipient forwarded it to another mailbox.

If you received this message

Treat it as weaker evidence, not as a red flag. Plenty of small organizations send unsigned mail. But banks, payment services, large retailers and the big mailbox providers all sign their mail. A message claiming to come from one of them with dkim=none is suspicious. See spotting phishing from headers.

If you own the domain

Turn on DKIM signing at every service that sends as your domain: your mailbox provider, newsletter tool, CRM, help desk and billing system. Each one gives you a selector record (often a CNAME) to publish under _domainkey. For a mail server you run yourself, generate a 2048-bit RSA key and publish it under a selector name you choose. Then send a test and check for dkim=pass with your own domain in header.d.