DKIM public key invalid
Published DKIM key material cannot be used for verification.
Problem summary
Published DKIM key material cannot be used for verification.
Symptoms
- Selector resolves but key cannot verify signatures
- Truncated or corrupted p= value in DNS
- Wrong key type or empty public key
Possible causes
- TXT split/concatenation errors
- Copied private material or wrong key
- Stale key after regenerating in the ESP
How to diagnose
- Compare live DNS p= to the ESP’s displayed public key
- Check for missing characters, spaces, or quotes
- Confirm v=DKIM1 and key type fields when present
How to fix
- Republish the exact public key from the signing platform
- Regenerate keypair in the ESP and update DNS together
- Prefer provider CNAME delegation when they support it cleanly
How to verify
- Fresh signature verifies (dkim=pass)
- Key checkers accept the published record
Prevention
- Never hand-edit long base64 keys when a CNAME is available
- Dual-selector rotate instead of in-place overwrite when possible
When to escalate
- Production mail is failing for a material share of recipients after remediation attempts