What causes “bad signature” or “key not found” errors?

"Bad signature" and "key not found" both appear as dkim=fail or dkim=permerror in an email header, but they point at different problems. Knowing which one you're looking at cuts the debugging time in half.

"Key not found"

This means the receiving server looked up your DKIM selector in DNS and got nothing back. The public key isn't there, or it's published in the wrong place. Common causes:

• The record was never published. DKIM setup was started in your ESP but the TXT record was never added at your DNS provider.
• Wrong subdomain path. The record was published at yourdomain.com instead of selector._domainkey.yourdomain.com.
• Selector name mismatch. Your ESP signs with selector "s1" but you published the key at "k1".
• DNS propagation lag. The record was just added and hasn't fully spread yet. Wait 15 to 60 minutes and check again.

Find the selector name in the DKIM-Signature header of any outgoing email (the s= field). Then check whether that selector is actually published at your DNS with our DKIM checker.

"Bad signature"

This means the receiver found the record but the signature didn't verify. The key exists, but the hash didn't match. Common causes:

• Key mismatch. The public key in DNS doesn't match the private key your server is signing with. Usually happens after a key rotation where one side updated and the other didn't.
• Body or header modified in transit. A relay added content, changed encoding, or reordered headers after the message was signed.
• Corrupted public key in DNS. The p= value has extra spaces, a missing character, or was truncated during copy-paste. Even one wrong character breaks it.
• Wrong canonicalization mode. Simple mode signed the message one way, a relay touched it, and now the hashes don't match.

Paste the raw header from a failing message into our email header analyzer to see exactly what the receiver reported. If you've been staring at this for a while and it still doesn't make sense, the SOS hotline is free.