DIAGNOSTIC PLAYBOOK
DKIM selector returns NXDOMAIN
A selector lookup returning NXDOMAIN means the exact queried DNS name does not exist at that resolver. Build the lookup from the message's s and d tags rather than guessing a common selector name.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Read s and d from the failing signature and form selector._domainkey.signing-domain.
- Query the authoritative DNS service and a recursive resolver for the record or CNAME chain.
- Check for a duplicated domain suffix, deleted selector or premature key removal, then verify a new message.
What this looks like
ILLUSTRATIVE EXAMPLE
The signature uses s=mail2026 and d=example.com, but DNS contains mail2026._domainkey.example.com.example.com. The editor appended the zone name twice.
A mistake to avoid
An unsuccessful guessed-selector scan does not prove the domain has no DKIM. Use the selector from a real message.
Keep the result in context
A DKIM investigation needs a real signed message and the public key for its selector and signing domain. DNS alone cannot prove that a service is signing outgoing mail. Preserve the raw source when comparing messages so your own copy process does not change the bytes being checked.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.