Log in

Fixing DKIM errors when the selector is already correct

7 min read · updated 8 Nov 2026 · Timo Kessel

You have found the selector, and DKIM still fails? Then the cause is usually one of three areas. This guide shows how to narrow it down and fix it.

1. The key in DNS is wrong

Copy the TXT record completely and without line breaks. With providers that use quotation marks, the text must stay unchanged. One missing character in the public key is enough for the check to fail.

The DKIM checker shows whether the key is found in DNS and is valid.

2. The mail was changed after signing

A forwarding service, an antivirus scanner or an automatic footer can change the content. The hash then no longer matches, and DKIM fails even though the key and record are correct.

Check the Authentication-Results line in the header. If it reports a signature error, look at every station between the sender and the recipient.

3. The signature does not cover all parts

Important headers such as From or Subject must be part of the signature. If one of them is missing from the signature, the recipient cannot complete the check cleanly. The list of signed headers is in the h= field of the DKIM-Signature line.

What you can do now

  1. Check the record in DNS for completeness.
  2. Send a test mail and read the header.
  3. If the signature in the header does not match, clarify the stations in between with your provider.

You can find the selector itself in how to find your DKIM selector.

Read more