How to debug DKIM signature fails?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Your DKIM signature is failing and you don't know where to start. That's frustrating, especially when everything looks correct at first glance. The good news is there's a clear diagnostic path, and most DKIM failures come down to a small handful of causes.
If you want a quick sanity check first, our free DKIM Record Lookup tool will pull your record and flag obvious problems in seconds.
Step 1: Find your selector from the email headers
A selector is just a label your ESP uses to point mail servers to the right public key in DNS. Think of it like a sub-address within your domain's DKIM setup. You can have more than one, which is why finding the exact selector your message was signed with matters.
Open the original email in your client and view the raw headers. In Gmail, click the three-dot menu on a message and choose "Show original". In Outlook, open the message, go to File, then Properties, and look at the Internet headers box.
You're looking for a header that starts with DKIM-Signature:. Inside it, find the s= tag. That value is your selector. You'll also see d= which is the signing domain. Write both down.
Step 2: Check that the DNS record actually exists
Take your selector and domain, then query DNS for this record:
dig TXT selector._domainkey.yourdomain.comReplace "selector" with what you found in the header and "yourdomain.com" with the d= value. You should get back a TXT record containing v=DKIM1 and a p= value (the public key). If you get nothing back, the record is missing or the selector name doesn't match. That's your culprit.
Not comfortable with command-line tools? Use our DKIM Record Lookup instead. Paste in your domain and selector and it does the same query for you.
Step 3: Match against the four most common failure causes
Selector mismatch. Your ESP is signing messages with a selector that either doesn't exist in DNS or has a typo in the name. Double-check the selector string character by character. One wrong letter breaks everything.
Truncated public key. DKIM public keys can be long. Some DNS providers split them across multiple strings in a single TXT record (which is valid), but if the record was entered wrong, you'll end up with a broken key. Compare what's in DNS to what your ESP provided during setup.
Key rotation. You or your ESP rotated to a new DKIM key but removed the old one before messages signed with it were delivered (or before forwarded copies arrived). During a rotation, keep the old key live for at least 48 hours after you stop signing with it.
Message modification in transit. Forwarding and mailing lists sometimes alter the message body or headers after signing, which breaks the signature. This is expected behavior for those scenarios, not a configuration error on your end. DMARC alignment checks can still pass via SPF in these cases, so it's worth knowing which mechanism is doing the work.
Step 4: Send a test and read the result
Send a test email to a Gmail address you control. Open it, click "Show original", and look for the authentication results section near the top. You want to see dkim=pass. If you see dkim=fail or dkim=neutral, the specific reason is usually right there in the same line (for example, reason="signature did not verify").
You can also run your full setup through our Email Header Analyzer, which parses the authentication results and flags what's passing or failing in plain language.
Still stuck after all that? Our SOS hotline is free and we actually pick up. Drop us a message and we'll take a look with you.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
