DIAGNOSTIC PLAYBOOK
DKIM CNAME exists but its target is missing
A DKIM CNAME is only a pointer to the public key. If the target has no usable key, the alias can look correct in your dashboard while verification still fails.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Resolve the exact selector name and follow each CNAME to the final TXT response.
- Compare the target with the account-specific value supplied by the sending provider.
- Check that domain verification is complete at the provider, then ask its support team about an unresolved provider-controlled target.
What this looks like
ILLUSTRATIVE EXAMPLE
A copied target belongs to another tenant's configuration and no longer resolves. The local CNAME itself is valid, but the destination key is unavailable.
A mistake to avoid
Do not generate a replacement public key for a hosted provider. It must match the private key used by that provider's signer.
Keep the result in context
A DKIM investigation needs a real signed message and the public key for its selector and signing domain. DNS alone cannot prove that a service is signing outgoing mail. Preserve the raw source when comparing messages so your own copy process does not change the bytes being checked.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.