DKIM fails when the receiver cannot verify the message signature against the public key in your DNS. The usual causes are a missing or wrong selector, a revoked (empty) public key, the message body being modified in transit (e.g. by a mailing list), or the signing domain not aligning with your From domain. Each has a specific fix below.
DKIM keys live at {selector}._domainkey.yourdomain.com. The selector is chosen by your sending platform (e.g. google for Google Workspace, selector1/selector2 for Microsoft 365, s1/s2 for many ESPs). If you check the wrong selector, you’ll see a false failure.
No record / wrong selector: publish the exact TXT record your provider gives you at the exact selector. Revoked key (p= empty): the key was rotated or disabled — re-enable DKIM in your provider and republish. Body modified: a forwarder or list footer changed the message after signing; use relaxed canonicalization and rely on DMARC+DKIM alignment. Not aligned: the signing domain must match (or be a subdomain of) your From domain for DMARC to pass.
Replace google with your selector:
$ dig TXT google._domainkey.yourdomain.com +shortCheck your DKIM record now
Open the free DKIM checker →Check a received email’s headers for d= and s= in the DKIM-Signature line, or your sending platform’s DKIM setup page. The s= value is the selector.
The public key has been revoked. The selector record exists but carries no key, so every signature fails. Re-generate/enable the key in your provider.
