No DKIM key found at the selectors we checked

What causes this

DKIM keys live at selector._domainkey.yourdomain.com, and the selector name is chosen by whoever set up signing. There is no way to list the selectors a domain uses — DNS does not support enumeration — so any checker can only probe names it already knows about. We check the selectors published by the major mailbox and sending providers. Finding none does not prove DKIM is absent; it means DKIM is not present at any selector we know to look for.

What it breaks

If DKIM genuinely is not configured, your mail can only satisfy DMARC through SPF, which breaks whenever a message is forwarded. If DKIM is configured at a selector we do not know, there is no problem — check a message header to confirm.

How to fix it

Confirm your actual selector, and enable DKIM at every service that sends for you.

1. 1Open a message you sent recently and look at the Authentication-Results or DKIM-Signature header. The s= value is your selector.
2. 2If a selector is present there, DKIM is working and this finding can be ignored — enter the selector in the DKIM checker to verify it directly.
3. 3If no DKIM-Signature header exists, enable DKIM in each sending service's admin console and publish the record it gives you.