EmailNa

Home › For senders

DKIM fail: why it happens and how to fix it

DKIM adds a digital signature to every email you send. When it fails, receiving servers can't confirm the message really came from you, which hurts delivery and can break DMARC.

By David Ray · Updated November 3, 2026 · 3 min read · How we research

Quick answer

DKIM usually fails for one of four reasons: DKIM was never turned on for your domain, the public key in DNS is missing or pasted wrongly, the message was changed after it was signed (often by forwarding or a mailing list footer), or the signature uses a different domain from your From address, so it doesn't align. Check the email's headers to see which, then turn on DKIM in your email provider and publish its record.

New to these records? See SPF, DKIM and DMARC explained.

What "DKIM fail" means

Your mail server signs each outgoing message with a private key. The receiving server looks up the matching public key in your DNS, at a name like selector._domainkey.yourdomain.com, and checks the signature. In the message headers you will see dkim=pass, dkim=fail or dkim=none (no signature at all).

Common causes

CauseHow to fix it
DKIM never turned onTurn it on in your email provider and publish the record it gives you (steps below).
Record missing, mistyped or cut shortCopy the value again exactly. Long 2048-bit keys sometimes have to be split into several quoted strings in one TXT record; your DNS host's help explains how.
Message changed after signingForwarding services, mailing lists and some security gateways add footers or rewrite links, which breaks the signature. See forwarding and DMARC.
Key changed but DNS not updatedPublish the new public key, or switch back to the old selector until you do.
Signed with the provider's domain, not yoursDKIM passes but doesn't align with your From domain. Set up custom DKIM for your domain in that service.

How to check if DKIM is enabled

  1. Send an email from your domain to a Gmail or Outlook.com address you can open.
  2. Open the full headers: in Gmail, the three dots, then Show original.
  3. Look for a DKIM-Signature header and, in Authentication-Results, dkim=pass with header.d=yourdomain.com.

Paste the headers into the free email header analyzer to read the results in plain English, or run your domain through the DMARC checker, which looks for DKIM records at common selector names.

DKIM alignment, explained

For DMARC, it is not enough for DKIM to pass. The domain in the signature (d=) must match the domain in your From address. In the default "relaxed" mode, a subdomain counts: d=mail.yourdomain.com aligns with you@yourdomain.com. A signature from d=sendingservice.com does not, even if it passes.

Turn on DKIM in Google Workspace

  1. In the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email.
  2. Choose your domain and select Generate new record. The default selector is google.
  3. Add the TXT record it shows at your DNS host, at google._domainkey.
  4. Wait for it to publish, then return and select Start authentication.

This TXT value is what some guides call your "Google domain key".

Turn on DKIM in Microsoft 365

  1. In the Microsoft Defender portal, go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.
  2. Select your domain. Microsoft shows two CNAME records, selector1._domainkey and selector2._domainkey.
  3. Add both CNAMEs at your DNS host.
  4. Return and turn on Sign messages for this domain with DKIM signatures.

Can a domain have multiple DKIM records?

Yes, as long as each uses a different selector. That is normal when you send through several services, for example google._domainkey for Google Workspace and s1._domainkey for a newsletter tool. What breaks DKIM is two different TXT records on the same selector name.

Questions people ask

Does a DKIM failure mean my email goes to spam?
Not always. If SPF passes and aligns, DMARC can still pass. But DKIM failures make filtering more likely, and with DMARC at quarantine or reject, mail that fails both SPF and DKIM alignment is sent to spam or refused.
Why does DKIM pass but DMARC fail?
Because the DKIM signature is for a different domain from your From address. Set up custom DKIM for your own domain in the service that sends the mail.
How long does a new DKIM record take to work?
Usually within an hour, sometimes up to 48 hours. Turn on signing only after the record has published.
What is a DKIM selector?
A short name that tells receivers where to find the public key, such as google or selector1. It appears as s= in the DKIM-Signature header.
Sources checked

Keep reading