DKIM: selector record not found
The DKIM selector in your email's d= tag doesn't resolve to any DNS record. Receivers can't fetch the public key to verify your signature.
Without a resolvable selector, the receiver treats your mail as unsigned. Same deliverability penalty as having no DKIM at all.
What causes it
- You published the selector record on the wrong hostname. The record must live at exactly
._domainkey. - DNS hasn't propagated yet. You just published the record but the receiver is still cached on NXDOMAIN.
- Your mail provider rotated selectors and you didn't update DNS.
- The selector exists on a subdomain but your mail is signed as the apex (or vice versa).
How to fix it
Step 1: Identify the exact selector
Look at the DKIM-Signature header in a failed message. Find the d= and s= tags. The selector is the s= value, the domain is d=. You need a DNS record at exactly: ._domainkey.
Step 2: Query it directly
If nothing comes back, the record is missing or on the wrong host. If something comes back but is truncated, your DNS provider may be limiting TXT record length — split it into multiple quoted strings in the same record.
dig TXT <selector>._domainkey.<yourdomain>Step 3: Publish the correct record
Get the public key from your mail provider (Microsoft 365, Google Workspace, SendGrid, etc.) and publish it exactly as instructed. Wait at least 15 minutes for propagation before re-testing.
Fixed it? Run a fresh test to confirm.
Test my inbox →