How to Fix DKIM Fail: Step-by-Step Guide (2026)

A DKIM fail means your emails aren't cryptographically signed, making them look suspicious to spam filters. Here's a systematic approach to diagnose and fix DKIM failures in 6 steps.

⚡ Diagnose Now
Check your DKIM record using the SPF, DKIM & DMARC Checker or generate a new key pair with the DKIM Record Generator.

Understanding DKIM Failure

DKIM failure occurs when a receiving mail server attempts to verify your DKIM signature and cannot. This can happen for several reasons:

DKIM Signing Not Enabled: Your Email Service Provider (ESP) or mail server isn't configured to sign outgoing emails with your DKIM private key.
Missing DNS Record: The public key isn't published in your DNS, or it's published at the wrong selector subdomain.
Key Mismatch: The private key on your server doesn't match the public key in your DNS.
Selector Mismatch: The selector used by your ESP doesn't match the selector in your DNS record.
DNS Record Too Long: The TXT record exceeds 255 characters, causing some DNS providers to truncate it.

Step 1: Check if DKIM Signing is Enabled

This is the most common and easiest fix. Log in to your Email Service Provider (ESP) or mail server administration panel.

Google Workspace: Admin Console > Apps > Gmail > Authenticate email. Enable DKIM for your domain.
Microsoft 365: Exchange Admin Center > Mail flow > Connectors. Configure DKIM signing.
SendGrid: Settings > Sender Authentication > Domain Authentication. Verify DKIM is enabled.
Mailchimp: Account > Settings > Domain Authentication. Verify DKIM status.
Custom Mail Server: Check your MTA (e.g., Postfix, Exim, Sendmail) configuration for DKIM signing settings.

If DKIM signing is disabled, enable it and proceed to test again.

Step 2: Verify the DNS Record is Published

Use our SPF, DKIM & DMARC Checker to verify your DKIM record is live.

Enter your domain and the exact selector your ESP uses.
Click "Check Records."
Look for the DKIM section. If it says "No DKIM record found," your public key isn't published correctly.

If the record is missing, add it as a TXT record at ._domainkey. with the value provided by your ESP or our DKIM Generator.

Step 3: Check the Selector

Your ESP uses a specific selector to sign emails. This selector must match exactly with the one in your DNS record.

Common selectors:
- Google Workspace: google (or a custom one you set)
- Microsoft 365: selector1 or selector2
- SendGrid: s1 or s2
- Mailchimp: mailchimp
- Amazon SES: ses

If you're unsure what selector your ESP uses, check their documentation or support page. A selector mismatch is a common cause of DKIM failure.

Step 4: Check for Key Mismatch

If the record exists but still fails, the private key on your server may not match the public key in DNS. This often happens when:

You generated a new key pair but only updated the DNS record.
You generated a new key pair but only updated your ESP's configuration.
You have multiple ESPs using the same selector with different keys.

Fix: Generate a new 2048-bit key pair using our DKIM Record Generator. Update both your DNS record and your ESP configuration simultaneously with the new keys.

Step 5: Handle Long TXT Records

Some DNS providers limit TXT strings to 255 characters. A 2048-bit DKIM record easily exceeds this limit. If your DNS provider truncates the record, DKIM will fail.

Fix: Check your DNS provider's documentation for "long TXT record" support. Most providers allow you to split the record into multiple quoted strings:

"v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC..."

"...GSIb3DQEBAQUAA4GNADCBiQKBgQC..."

The DNS provider will concatenate these strings automatically. If your provider doesn't support this, you may need to use a 1024-bit key as a fallback (though this is weaker).

Step 6: Test Again

After making changes, wait for DNS propagation (a few minutes to 48 hours). Then:

Send a test email from your production setup.
Use the Email Tester to see if DKIM now passes.
Check the email headers with our Email Header Analyzer to see the DKIM signature details.

Common DKIM Fix Mistakes

Typo in DNS Record: A single character mistake in the public key string breaks everything. Always copy-paste from the generator.
Wrong Selector: Using the wrong selector in your DNS record or ESP configuration.
Not Waiting for Propagation: Checking too quickly after updating DNS. Give it at least an hour.
Multiple ESPs with Same Selector: Using the same selector for different ESPs with different keys causes conflicts.

Frequently Asked Questions

What is a DKIM selector, and how do I find mine?

A selector is a label that identifies a specific DKIM key. It's part of the DNS record name: ._domainkey.. Check your ESP's documentation for the exact selector they use.

Can I have multiple DKIM records for the same domain?

Yes! That's the purpose of selectors. You can have multiple records at different selectors (e.g., default._domainkey and google._domainkey).

How long does it take for DKIM changes to propagate?

DNS propagation varies by provider. Cloudflare propagates almost instantly, while others may take a few hours. Use our checker to confirm when it's live.

Why is my DKIM passing in tests but failing in real emails?

Your ESP may be signing emails from some servers but not others. Ensure DKIM signing is enabled for all outgoing mail streams, including transactional and marketing emails.

Conclusion

Fixing DKIM fail is a systematic process: enable signing, verify your DNS record and selector, check for key mismatches, and handle long TXT records. The most common cause is simply not having DKIM signing enabled in your ESP.

Ready to fix your DKIM? Start by generating a new key pair with our DKIM Record Generator.