When DKIM fails, the receiver could not confirm the signature of a message. A handful of causes explain most cases.
The signature names a selector, and the receiver looks for the key at that name in your DNS. A missing record, a mistyped selector or a record under the wrong domain stops the check.
If the key in DNS is not the one that matches the signing key, the signature cannot be verified. This often happens after a provider changes keys or a record was pasted incompletely.
Anything that changes a signed part of the message breaks the signature. Mailing lists and some gateways add footers or rewrite headers, which causes failures.
Some services only sign after you enable DKIM for your domain. Until then, the messages leave without a signature that could be checked.
DNS Domain Detective shows whether the DKIM records for your selectors are in place. Open DNS Domain Detective
DNS Domain Detective is now available on the App Store.
Last reviewed: 2026-11-02
#DNS #DKIM #SPF #DMARC #EmailSecurity #SysAdmin #MSP #iOS
This page gives general information and is not legal, financial or medical advice. [email protected]