On this page

Fixing DKIM Record Issues

What it does

DKIM (DomainKeys Identified Mail) lets receiving mail servers verify that a message wasn't altered in transit, by checking a digital signature against a public key published in your DNS.

Unlike SPF, DKIM is set up per sending platform — you can't create a DKIM record from scratch yourself, because the private key is generated by whichever service actually sends your mail. Your part is publishing the DNS record that platform gives you.

How to fix it

  1. In each platform you send email from (e.g. Microsoft 365, Google Workspace, HubSpot, Amazon SES), find the DKIM setup section — this generates a CNAME or TXT record and a unique "selector."
  2. Add the record the platform gives you to your DNS, exactly as shown (usually a CNAME record like selector1._domainkey.yourcompany.com).
  3. Return to the sending platform and confirm/verify DKIM — most platforms will check the DNS record automatically.
  4. Repeat for every platform that sends mail on your domain's behalf, not just your primary mailbox provider.
  5. Re-run a scan to confirm DKIM is detected.

Common pitfalls

  • Only enabling DKIM for your main mailbox provider and forgetting about marketing/transactional tools (e.g. a CRM or email marketing platform that also sends as your domain).
  • Copying the record incorrectly (extra dot, wrong selector name) — copy-paste directly from the provider's instructions rather than retyping.
  • Your DNS not responding correctly to a DKIM lookup for a selector that doesn't exist — some scanners expect a specific "no record" response (NOERROR), which can be affected by unusual DNS host configurations.