What to do when DKIM record is configured but emails are not DKIM signed?
Summary
What email marketers say10Marketer opinions
Email marketer from StackExchange shares that the issue could stem from domain settings not propagated correctly. Ensure the DNS records have fully propagated and are accessible from all global DNS servers.
Marketer from Email Geeks responds saying that if “your provider” refers to your ESP, you should discuss getting DKIM signatures in your messages with them.
Email marketer from Email Geeks shares that you need to ensure you've turned on the "activation" for DKIM signing from your ESP portal once you got your public key in DNS.
Email marketer from Email Marketing Forum recommends contacting your Email Service Provider's (ESP) support team. They can often diagnose and resolve issues related to DKIM signing on their end.
Email marketer from StackOverflow suggests examining an outgoing email's raw source to confirm whether the DKIM signature is being added. This helps identify if the issue is on the sending side.
Email marketer from Email Deliverability Forum recommends checking the sender domain configuration in your email platform. It must match the domain for which the DKIM record is created.
Email marketer from Email Geeks explains that it may be the earlier email vendor's DKIM record and to contact your current vendor and say that you'd like to sign DKIM on your sender domain and they will help you with the next steps.
Email marketer from StackOverflow recommends verifying that the sending server is actually configured to use the DKIM key for signing outbound emails. It's possible the record is present but not actively used by the mail server.
Email marketer from Super User suggests checking the email headers to see if the DKIM signature is present and valid. The header will indicate if DKIM signing was attempted and whether it passed or failed.
Email marketer from Reddit highlights that you might need to specifically activate DKIM signing in your email sending platform's settings. Some platforms require you to enable it even after the DNS records are in place.
What the experts say4Expert opinions
Expert from Email Geeks asks if the private key was sent to your ESP and if they turned on signing.
Expert from Wordtothewise responds that you should confirm that the selector in your DKIM record matches the selector used in your email headers. A mismatch will cause the verification to fail.
Expert from Spamresource explains that one needs to verify that the signing is actually happening on your emails and not just assume the ESP is doing it. Check the headers to see if the DKIM-Signature header is present.
Expert from Email Geeks explains there are two parts to DKIM: the record within your DNS (with the public key), and the mail server sending your mail has to be configured to sign the mail (with the private key).
What the documentation says5Technical articles
Documentation from Microsoft shares the importance of verifying that the DKIM keys are published correctly by checking the DNS records and ensuring the selector matches the key length configured.
Documentation from Google explains that if DKIM signing fails, start by checking if DKIM is enabled for the domain, verifying that the correct selector is being used and confirming that the private key is correctly configured on the sending server.
Documentation from MailChannels explains that a common cause is using an incorrect selector in your email configuration. Double-check that the selector used by your sending server matches the selector in your DKIM DNS record.
Documentation from dmarcian shares that troubleshooting DKIM failures involves checking the DNS record for accuracy, ensuring the private key on the mail server matches the public key in DNS, and verifying that the email content hasn't been altered in transit.
Documentation from AuthSMTP explains that DNS propagation can take time, especially after making changes. Use online tools to check if your DKIM records have propagated globally.