DKIM failures mean emails aren't being verified as authentic, potentially landing them in spam or failing DMARC. This guide covers how to diagnose and fix common DKIM issues.
Common DKIM Errors
1. DKIM Record Not Found
Error: "No DKIM record found" or "DKIM: none"
Causes:
- DNS record not published
- Wrong selector name
- DNS propagation not complete
- Record at wrong subdomain
Solutions:
- Verify record exists:
dig TXT selector._domainkey.yourdomain.com - Check selector name matches what the service uses
- Wait up to 48 hours for DNS propagation
- Confirm record is TXT type (not CNAME if TXT is required)
2. DKIM Signature Verification Failed
Error: "DKIM: fail" or "body hash did not verify"
Causes:
- Message was modified in transit
- Public key doesn't match private key
- Malformed DKIM record
Solutions:
- Check for email modification (footers, tracking pixels added after signing)
- Regenerate keys if mismatch is suspected
- Verify record syntax is correct
3. DKIM Key Too Short
Error: "Key too weak" or security warnings
Cause: Using 512-bit keys (deprecated)
Solution: Generate new 1024-bit or 2048-bit keys
4. Multiple DKIM Records for Same Selector
Error: Inconsistent DKIM results
Cause: Two TXT records with same selector name
Solution: Remove duplicate records; keep only one per selector
Diagnosing DKIM Problems
Check DNS Record
dig TXT selector._domainkey.yourdomain.com
You should see a TXT record starting with v=DKIM1
Check Email Headers
In received email, look for:
-
Authentication-Resultsheader with dkim=pass or dkim=fail -
DKIM-Signatureheader showing signing details
Use Online Tools
- MxToolbox DKIM Lookup
- Send email to mail-tester.com
- EasyDMARC DKIM Checker
Service-Specific DKIM Issues
Google Workspace
- Default selector is "google"
- Must explicitly enable DKIM in admin console
- Click "Start authentication" after adding DNS record
Microsoft 365
- Uses CNAME records, not TXT
- Selectors are selector1 and selector2
- Must enable in Security & Compliance center
Third-Party Services
- Each has different selectors
- Some use CNAME, some use TXT
- Check their documentation for exact records
DKIM Key Rotation
If keys might be compromised or you're doing security rotation:
- Generate new keys in your email service
- Add the new DNS record (with different selector)
- Activate new key for signing
- Keep old record for a week (in-transit emails)
- Remove old record
For complete DKIM setup, see our DKIM configuration guide.
0 comments