Fix Missing DKIM Signature on Outbound Email

What's happening

DomainKeys Identified Mail (DKIM), defined in RFC 6376, attaches a cryptographic signature to outgoing messages and publishes the corresponding public key as a TXT record at._domainkey.. Receivers retrieve the public key, verify the signature against the message body and selected headers, and gain a strong cryptographic guarantee that the message originated from a server holding the private key.

When DKIM is missing, receivers see no DKIM-Signature header and report dkim=none in Authentication-Results. Combined with SPF and DMARC failures, this leaves the message with no surviving authentication path and DMARC alignment is impossible.

DKIM is mandatory for Google's February 2024 bulk-sender requirements. Senders of 5,000+ messages per day to Gmail must DKIM-sign every message with a key of at least 1024 bits. Failure to comply triggers temporary failures (421 4.7.0) and permanent rejects (5.7.26 unauthenticated email is not accepted).

Why it matters

Without DKIM, mail forwarded through mailing lists or aliases breaks SPF (envelope is rewritten) and has nothing to fall back on, so DMARC fails and the message is rejected or junked. Customers using mailing lists,.edu forwarding, or corporate aliasing are most affected.

Reputation damage compounds. Gmail Postmaster Tools shows the IP reputation hit and domain reputation drop, and Microsoft 365 SmartScreen treats unsigned mail as an antispam signal. Mail-Tester scores drop by 1.5-2.0 points.

Brand impersonation risk multiplies. With no DKIM, attackers can spoof your domain with no cryptographic barrier. DKIM with DMARC is the standard countermeasure for executive impersonation and B2B phishing.

Common causes

• ESP onboarding skipped the DKIM step and only set up SPF.
• DKIM was configured for one ESP but not enabled for all sending services (e.g. SendGrid signed but Mailgun unsigned).
• Selector TXT record was published incorrectly (truncated, wrong name, or wrong type).
• ESP was migrated and the new DKIM keys were never published.
• Internal mail server (Postfix, Exim) sends mail without OpenDKIM or rspamd-signing configured.

Detect this on your site

Run a quick scan with the Email Checker. The tool surfaces this exact issue with the records and context needed to apply the fix below.

How to fix it

1. 1

   Locate your ESP's DKIM setup page

   Every ESP has a domain-authentication or sending-domain section: SendGrid Sender Authentication, Mailgun Domain Verification, Postmark Sender Signatures, Resend Domains, Amazon SES Verified Identities. Generate or retrieve the DKIM public key and selector name.

2. 2

   Choose a selector convention

   Use a per-vendor selector like sg1._domainkey for SendGrid, mg._domainkey for Mailgun, k1._domainkey for Postmark, and a year-stamped selector like 2026a._domainkey for self-hosted infrastructure. Multiple selectors per domain is normal — receivers look up the selector named in the DKIM-Signature header.

3. 3

   Publish the DKIM TXT record

   Create a TXT record at._domainkey.example.com with the value v=DKIM1; k=rsa; p=. The base64 string is long (370+ characters for a 2048-bit key) — most DNS providers handle the chunking automatically. TTL 3600 is fine.

4. 4

   Verify with dig and the ESP's check tool

   Run dig +short TXT sg1._domainkey.example.com and confirm the v=DKIM1 record returns. Then click the ESP's "Verify DNS" button — it confirms the public key matches their private key and enables signing.

5. 5

   Send a test and read the headers

   Send a message to a Gmail account (or mail-tester.com), open Show Original, and read the Authentication-Results line. Look for dkim=pass header.d=example.com — the d= value must match your domain (alignment).

6. 6

   Repeat for every sending service

   Inventory every service that sends as your domain (transactional, marketing, CRM, support tool, internal apps). Each requires its own DKIM selector. Missing one means part of your mail flow is unsigned and DMARC enforcement breaks.

Example

; DKIM TXT record for SendGrid selector
sg1._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1vR7...truncated...QIDAQAB"

Single 2048-bit DKIM TXT record at the per-vendor selector.

Related fixes