DKIM Signature Invalid: How to Fix DKIM Authentication
DKIM signature validation is failing on your outgoing emails
Fix within hours to restore authentication and avoid spam folder.
Check your DKIM setup:
Run the DKIM record checker
Verify the DKIM public key is published in DNS
Check if your selector (default: "default", "selector1", "k1") matches your ESP setting
Send a test email and check headers for DKIM-Signature
What Could Be Causing This?
DKIM Public Key Not Published in DNS
Most CommonDKIM requires a public key in DNS. If not published, DKIM verification fails.
How to confirm:
Run DKIM record checker. Look for the TXT record at [selector]._domainkey.[domain].
Selector Mismatch (ESP selector doesn't match DNS)
CommonYour ESP signs with a specific selector (e.g., "default"). DNS must have the matching key at that selector.
How to confirm:
Check your ESP settings for the DKIM selector. Verify DNS has the key at [selector]._domainkey.com.
DKIM Key Expired or Rotated
CommonESPs rotate DKIM keys periodically. If the key in DNS is outdated, verification fails.
How to confirm:
Contact your ESP for the current DKIM public key. Compare to DNS.
Subdomain DKIM Signing (Not Aligned with From Domain)
Less CommonYour ESP may sign with a key from a subdomain (e.g., mail.esp.com), but DKIM alignment requires signing with a key from the "from" domain.
How to confirm:
Check DKIM signature in email headers — does the signature domain match your from domain?
Fix Playbook
Step 1: Publish DKIM Public Key to DNS
- Get DKIM public key from your ESP
- Create DNS TXT record at [selector]._domainkey.[domain]
- Paste the public key (ESP provides the exact format)
- Test with DKIM record checker
- DNS propagation: typically 5 min to 48 hours
Step 2: Verify Selector Configuration
- Check your ESP's DKIM selector setting
- Ensure DNS has the key at the matching selector name
- If you changed selectors, update both ESP and DNS to match
- Test to verify DKIM signature is added to headers
Step 3: Request Domain-Level DKIM (Not Subdomain Signing)
- Contact your ESP — request domain-level DKIM signing
- Some ESPs default to subdomain signing; ask if you can switch to domain signing
- This ensures DKIM aligns with your from domain for DMARC
Prevention Checklist
- Monitor DKIM record quarterly — ESPs rotate keys periodically
- Test DKIM with checker tool after ESP changes
- Keep selector name consistent; document it
- Use domain-level DKIM signing, not subdomain
- Verify DKIM signature in email headers regularly
Free Diagnostic Tools
Stop Fixing Deliverability Issues Reactively
The problem you just fixed probably cost you 20-30% of revenue while it was happening. InboxEagle would have detected it within 2 minutes and alerted you before placement dropped.
Real-time monitoring, AI diagnosis, and 24/7 alerts for every reputation change.
Start 14-Day Free Trial — No Card Needed