DKIM Record Not Found: Find Your Selector and Publish the Key

DKIM (DomainKeys Identified Mail) adds a hidden digital signature to every email you send. Receiving servers check that signature against a public key published in your DNS. "DKIM record not found" means that key is missing, or you are looking in the wrong place, so your mail cannot be verified.

Step 1: get the selector and key from your email provider

DKIM keys live at a special name: selector._domainkey.yourdomain.com. The selector is a label chosen by your sending service, so you cannot guess it. Open the domain authentication page of each service that sends mail as your domain (mailbox host, newsletter tool, website mail plugin, helpdesk). It shows the selector and either a TXT value or a CNAME target.

Common selector examples are google for Google Workspace, selector1 and selector2 for Microsoft 365, and provider-specific names for others. Always use the value your own provider shows.

Step 2: check what is currently in DNS

With your selector in hand, query the exact name:

dig TXT google._domainkey.example.com +short

On Windows:

nslookup -type=TXT google._domainkey.example.com

Some providers use a CNAME instead of a TXT record, so also try dig CNAME selector1._domainkey.example.com +short. A healthy TXT result starts with "v=DKIM1; and contains a long p= value. An empty result means the record is missing or sits at a different name.

Step 3: publish the record

Add the record exactly as your provider shows it, in the DNS zone that is actually live for your domain (check with dig NS example.com +short).

Field	Value
Type	TXT (or CNAME if your provider says so)
Name	selector._domainkey (many panels add the domain for you)
Value	The full string from your provider, starting with v=DKIM1

Two traps catch people here. Some DNS panels append the domain automatically, which produces selector._domainkey.example.com.example.com. And long keys are sometimes split into several quoted chunks, which is normal, but stray spaces or line breaks inside the key break it. Copy and paste, do not retype.

Step 4: switch signing on and test

Publishing the key is not always enough. In many providers you must also click an "Authenticate" or "Start signing" button after the DNS record is found. Allow up to a few hours for DNS to update, then send a test message to a mailbox you control and open the original message source. Look for:

Authentication-Results: ... dkim=pass header.d=example.com

header.d should be your own domain. If it shows the provider's domain instead, mail is signed but not aligned with your From address, which matters for DMARC.

Step 5: fix a key that exists but fails

• dkim=fail (body hash did not verify): something changed the message after signing, such as a mail footer added by another system.
• dkim=neutral or none: the message was sent without a signature. Signing is not enabled for that sender.
• Key too short: use a 2048-bit key where your provider allows it.

Pair DKIM with a correct SPF record so mail passes in more situations.

Common mistakes

• Publishing the record on the root domain instead of under _domainkey.
• Guessing the selector instead of reading it from the provider.
• Adding the record but never enabling signing in the provider.
• Setting up DKIM for the mailbox host and forgetting the newsletter or website mail sender.
• Deleting an old selector while a service still signs with it.