DKIM: no signature found

Your email landed with no DKIM signature header at all. Your sending server isn't signing outbound mail.

Impact — High impact

No DKIM means no cryptographic proof you authorized the message. Receivers (especially Gmail and Microsoft 365) heavily penalize unauthenticated email. If you also publish DMARC with p=reject, your mail will be rejected outright.

What causes it

You never enabled DKIM. Most mail platforms require you to opt in and publish a DNS record per domain. Default is OFF.
You're sending from a 3rd-party service (SendGrid, Mailchimp, HubSpot) and skipped the DKIM configuration step. They won't sign on your behalf until you authorize them.
Your mail is routed through a relay that strips DKIM. Some old firewall and gateway appliances remove signing headers.
Direct SMTP from an app or script without a signing proxy. mail(), sendmail, or a bare Postfix install without OpenDKIM will send unsigned.

How to fix it

Microsoft 365

Admin Center → Defender → Policies & Rules → Email authentication settings → DKIM. Select your domain, Enable, then add the two CNAME records they generate to DNS.

Google Workspace

Admin → Apps → Google Workspace → Gmail → Authenticate email. Generate the key, publish the TXT record, wait 48 hours, then click "Start authentication."

SendGrid / Mailgun / Postmark / Resend

All these services guide you through DNS record creation during domain verification. If you skipped it, go back to your domain settings in their dashboard and complete DKIM setup. Unverified domains send unsigned.

Self-hosted mail server

Install OpenDKIM or rspamd, generate a key, publish the public key as a DNS TXT record at selector._domainkey.yourdomain.com, and configure your MTA to sign outbound mail.

Fixed it? Run a fresh test to confirm.

Test my inbox →