dkim=fail reason="key not found in DNS"

Classification differs by verifier (`fail` in OpenDKIM, `neutral (no key)` in mailauth — both reproduced), which is why the same message can look different in your own server's headers and at large mailbox providers; Gmail's headers commonly read `dkim=neutral (no key for signature)`, a live-service wording that cannot be reproduced in a container. A DNS timeout instead of a missing record gives `dkim=temperror`.

What it means

The message carries a DKIM signature for selector `s=` and domain `d=`, but the TXT record `<selector>._domainkey.<domain>` does not exist, so the receiver cannot verify anything. OpenDKIM reports it as `dkim=fail` with this reason; other verifiers classify the same condition differently — mailauth as `dkim=neutral (no key)`, some as `dkim=permerror`. For DMARC none of them counts as a DKIM pass.

Why it happens

• The selector's record was never created

  common

  A new signing key (or a new email provider) started signing with a selector before its TXT record was added. ESPs such as Google Workspace, Microsoft 365 or SendGrid only start signing correctly once their records exist.

• The record exists under a slightly different name

  common

  DNS panels that append the zone name produce `s2026._domainkey.example.com.example.com`; a record created in the parent zone while a subdomain is delegated elsewhere is not found either.

• CNAME target or split record broken

  occasional

  Providers that use CNAMEs to their own key records (`s1._domainkey → s1.domainkey.u123.wl.sendgrid.net`) fail if the CNAME is missing or points to a removed target.

• The key was removed while mail still uses it

  occasional

  Removing the old selector immediately after rotation breaks messages still in queues or being re-verified later (forwarding, ARC).

How to fix it

1. 1.

   Query the exact record name

   Build the name from `s=` and `d=` of the signature header and query it from outside your network.

   # s= and d= from the DKIM-Signature header name the record: <s>._domainkey.<d>
   dig +short TXT s2026._domainkey.example.com
   dig +short TXT s2026._domainkey.example.com @1.1.1.1   # bypass local caches

2. 2.

   Publish the key and keep old selectors for a while

   Publish the new selector before signing with it, and keep the previous one for some days after switching.

   ; zone example.com - long keys are split into several quoted strings of at most 255 characters
   s2026._domainkey  IN TXT ( "v=DKIM1; k=rsa; "
                              "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..." )

← Browse the full signature error database