DNS guides

DKIMBreaks authentication

DKIM record not found: turn on signing and publish the key

No DKIM key at the common selectors. Turn on DKIM signing at your email provider and publish its key, or check with your custom selector.

What it means

DKIM signs each message with a private key; receivers check the signature against a public key you publish at <selector>._domainkey.<yourdomain>. The selector is a name your provider picks, such as google or selector1.

DNS can't list every selector on a domain, so a checker has to guess. We try the selectors the big providers use. Not finding one means either DKIM isn't set up, or it uses a selector we didn't try.

Why it matters for cold email

DKIM is the authentication that survives forwarding, and DMARC needs SPF or DKIM to pass and align with your domain. Without DKIM a single SPF problem fails DMARC for all your mail. Gmail and Yahoo require it from bulk senders.

How to fix it

  1. In your email provider's admin console, turn on DKIM signing for the domain and generate a key (2048-bit if offered).
  2. Publish the record it gives you exactly: a TXT record at <selector>._domainkey, or CNAME records for Microsoft 365.
  3. Back in the console, start authentication or confirm the key.
  4. Re-check the domain; if your provider uses a custom selector, enter it under Advanced in the checker.

Questions

Where do I find my selector?

Open the headers of an email you sent and look for DKIM-Signature: the s= tag is the selector and d= is the signing domain.

My provider says DKIM is on, but the checker can't find it

The key may be published under a selector we don't try, or still waiting on DNS. Check with your selector; if it's still missing, the record wasn't published.

Related problems

Last checked 2026-10-21 against RFC 7208 (SPF), RFC 6376 (DKIM) and RFC 7489 (DMARC). Full setup guide

Sending cold email? Outsquid re-checks these records for every sending domain every hour, so a broken one doesn't go unnoticed. How deliverability works