Why aren't my DKIM records validating even though they are accurate?
Summary
What email marketers say12Marketer opinions
Email marketer from Mailjet explains that if you've recently changed your DKIM records, the old records might be cached by DNS resolvers. Flush your DNS cache or wait for the cache to expire to ensure resolvers fetch the updated records. Your ISP can help you to do this if you're not technical.
Email marketer from EmailGeeks Forum suggests checking if there are any firewalls or security settings blocking access to your DNS records. Some firewalls may interfere with DNS lookups, preventing email servers from verifying your DKIM signature.
Email marketer from MXToolbox suggests that a missing or incorrect selector is the most likely problem if a DKIM check is failing. Selectors are used to locate the public key that corresponds to the private key used to sign the email. The selector must match the one used when generating the DKIM signature.
Email marketer from Gmass shares that if you're using a shared hosting environment, another user on the same server might have misconfigured their DKIM records, affecting your domain's reputation. Contact your hosting provider to investigate and resolve any shared IP issues.
Marketer from Email Geeks explains DNS managed in Shopify will show *.<http://googledomains.com|googledomains.com> as the source. Crystal also clarifies that Flodesk uses fde as the selector, and it appears the 3 from Recapture haven’t been added to Shopify.
Marketer from Email Geeks explains that the records exist in AWS/Route53, but AWS is not hosting DNS for <http://egoswim.com|egoswim.com>. Google is hosting DNS for <http://egoswim.com|egoswim.com>.
Email marketer from EasyDMARC explains that incorrect DKIM key length can cause validation issues. Ensure your DKIM key meets the minimum length requirement (e.g., 1024 bits). Shorter keys are often considered insecure and may be rejected by email providers.
Email marketer from Mailosaur shares that some email providers might temporarily reject emails with invalid DKIM signatures due to reputation concerns. Check your domain's reputation using online tools and ensure it's not blacklisted. Address any reputation issues to improve email acceptance rates.
Marketer from Email Geeks points out that the DKIM public keys may not exist in DNS, leading to DKIM failures. Todd indicates that <http://egoswim.com|egoswim.com>'s DNS is hosted by Squarespace/Googledomains, creating confusion with the mention of GoDaddy/AWS and indicating there is a disconnect.
Email marketer from Reddit shares that a common mistake is adding the domain name twice to the DKIM record. Some DNS providers automatically append the domain, so adding it manually results in an incorrect record like 'selector._domainkey.yourdomain.com.yourdomain.com'.
Email marketer from SocketLabs shares that having multiple DKIM records with overlapping selectors can create conflicts and validation failures. Each selector should be unique to avoid ambiguity. If you have multiple sending services, use distinct selectors for each.
Email marketer from StackOverflow explains that some DNS providers automatically convert underscores in DNS records to hyphens. Verify that the underscores in your DKIM selector are not being altered. If so, contact your DNS provider for assistance.
What the experts say3Expert opinions
Expert from Email Geeks says there is no DKIM key published at whdyp2ro6wufcdub23jrq4i74jghn2gh._<http://domainkey.egoswim.com|domainkey.egoswim.com> and there is also no DKIM key published at flodesk._<http://domainkey.egoswim.com|domainkey.egoswim.com>.
Expert from Email Geeks indicates the problem is likely an incorrect DNS configuration, specifically with the hostname setup. Laura asks for the selector to find the hostname.
Expert from Word to the Wise explains that DNS inconsistencies can happen. What you *think* you've published may not be what is visible to the world. Use online tools at Word to the Wise to check the record and verify it's existence.
What the documentation says5Technical articles
Documentation from AWS Documentation shares that DNS propagation delays can cause temporary DKIM validation failures. After updating DNS records, allow sufficient time (up to 48 hours) for the changes to propagate across the internet. Use DNS lookup tools to verify the record's presence.
Documentation from Google Workspace Admin Help explains that a common reason for DKIM validation failure is incorrect DNS record setup. The record may be missing, have typos, or not be propagated yet. Ensure the selector and domain match the signing domain.
Documentation from dkim.org explains that DNS Servers can truncate long DNS records. For long keys, zone file formats that do not automatically concatenate strings may cause problems. The DKIM key must be a single string in the DNS record.
Documentation from RFC Editor shares that the DKIM record MUST be a TXT record. Ensure it is correctly formatted. For example the 'v=DKIM1; k=rsa; p=...' value is present and correct and the value doesn't exceed 255 characters.
Documentation from Microsoft Learn explains that if DKIM records are not validating, it could be due to syntax errors in the DNS record. Check for extra spaces, incorrect characters, or line breaks. Also, ensure the record is published as a TXT record and not a CNAME or other type.