Guide
How to diagnose a DKIM failure
Trace a DKIM failure from the DNS record to the signing configuration and identify the root cause.
The situation
DKIM failures occur when a receiving server cannot verify the cryptographic signature on an outgoing message. This can happen because the DNS public key record is missing, the signing configuration is misconfigured, or the sending platform is not signing correctly.
Before you begin
For agencies: When managing infrastructure for a client, confirm the sending platform's signing configuration with the team responsible for that platform before making DNS changes.
The operational path
The goal isn't just to find the error. The goal is to move from detection to a verified infrastructure state.
What could have caused this?
Cause
What changed
Possible impact
DNS record missing
Public key record not published
DKIM fails — no key to verify against
Wrong selector
Sending platform uses a different selector
DNS lookup returns no record
Key mismatch
DNS key does not match signing key
Signature verification fails
Record syntax error
Malformed TXT record
Record cannot be parsed
Platform not signing
Sending platform DKIM not enabled
Messages sent without signature
Step by step
Check a message header from the affected domain to confirm DKIM is failing and note the selector being used.
What to check
Expected result: You now know the selector, the signing domain, and whether the failure is at lookup or verification.
With Infraova
Infraova monitors DKIM record state continuously and alerts when a public key record changes or becomes unreachable — before a message failure surfaces it.
Use the selector from the message header to look up the DNS record and compare it against what the sending platform expects.
What to check
Expected result: You can now identify whether the failure is in DNS (missing or wrong record) or in the sending platform (not signing or signing with a different key).
Determine which of the common failure patterns applies to this situation before proposing a fix.
What to check
The fix depends on the root cause. In most cases, either the DNS record needs to be updated to match the sending platform, or the sending platform needs to be reconfigured.
What to check
With Infraova
Infraova generates the exact DNS record value needed to resolve the DKIM failure. The proposal includes the selector, the record value, and the reason before your team approves it.
After the change is applied, confirm DKIM is passing for outgoing messages.
What to check
Expected result: DKIM is passing, the record is correct, and the change is documented.
You decide. Infraova executes.
Infraova can propose and execute an approved infrastructure change, but it does not independently decide to modify client infrastructure. Every proposed change requires explicit authorization before execution.
Key takeaway
Most DKIM failures trace back to a mismatch between the DNS public key record and the key the sending platform is using to sign. Find the mismatch, determine which side needs to change, and verify the result after applying the fix.
Turn this playbook into a continuous workflow
Without Infraova
With Infraova
The guide teaches you how to solve the problem once. Infraova keeps watching for it after you're done.
Continue the playbook
Want the product-level details?
Guides answer "How do I solve this?" Documentation answers "How does Infraova work?"
Stop discovering infrastructure problems manually.
Infraova continuously monitors your client and business infrastructure, identifies meaningful problems, proposes the next action, executes approved changes, and verifies the result.