enforce verifiedimportantWritten by the Hub
Whether the algorithm is looked up in DNS
Not what its name suggests: it records whether the signing algorithm was stated explicitly, and therefore whether the engine needs to ask DNS.
In detail
Measured rather than read. The console computes this column from the algorithm choice — an explicit SHA1 or SHA256 writes 1, Auto-detect writes 0 — and the checkbox labelled "only use this key if it matches the public key found in DNS record" is overwritten in the process, so it does nothing at all. With 0 the engine looks up the published key at start-up to learn the algorithm, and says so when the record is missing: Error for DKIM key for … rcode 3 (NXDOMAIN). With 1 it signs without asking. For Hub, writing rows directly, the rule is simple: state the algorithm and write 1, so signing never depends on a DNS lookup succeeding at start-up.