Where you saw it: Authentication-Results reading dkim=permerror or dkim=none, a DKIM checker returning no record, or your sending platform reporting the domain as unverified.
Why it happens
- The record was never published. Generating a key inside a sending platform does not put anything in DNS; you still have to create the record.
- It was published at the wrong host. The record belongs at selector._domainkey, and many DNS panels append the domain automatically, which produces a doubled name if you type the full host.
- The selector in the signature does not match the selector in DNS, usually after a platform changed its default.
- The record is a CNAME your provider expects to point at their infrastructure, and it was created as a TXT record instead.
- DNS changes have not propagated yet. A long TTL on a negative answer can keep the old result alive for hours.
The fix, in order
Read the selector from a real message
Open the headers of a message you sent and find the DKIM-Signature line. The s= field is the selector, and the d= field is the domain. Query exactly those.
Query the record directly
Run dig +short TXT selector._domainkey.yourdomain.com. An empty answer confirms the record is missing rather than malformed.
Check for a doubled domain name
Look in your DNS panel for a host like s1._domainkey.example.com.example.com. That is what happens when a panel that appends the domain is given the full name.
Publish exactly what the platform gave you
Copy the record type, the host and the value from your sending platform's setup screen without reformatting. Some providers need a CNAME, not a TXT record.
Wait out the TTL before judging
A negative DNS answer is cached like any other. If you just published, give it the TTL of the zone before concluding it did not work.
How to know it worked
The short version
- dig +short TXT selector._domainkey.yourdomain.com returns a value starting with v=DKIM1.
- Your sending platform's dashboard shows the domain as verified.
- A test message shows dkim=pass in Authentication-Results.
Questions people ask
Where exactly does a DKIM record go?
At selector._domainkey.yourdomain.com, where the selector is whatever your platform put in the s= field of the signature. Both parts are required.
Can one domain have several DKIM records?
Yes, and it usually should. Each sending platform gets its own selector, so a domain sending through two services publishes two keys with no conflict.
Why does my platform want a CNAME instead of a TXT record?
So they can rotate the key on their side without asking you to change DNS again. Publish the CNAME they specify rather than converting it to a TXT record.