HighAuthentication · usually high
DKIM record is malformed
The record at this selector is not a valid DKIM key record.
Check your own domain
What causes this
A DKIM record is tag=value pairs and must contain a p= tag holding the base64 public key. The most frequent cause of a malformed record is the key being truncated or having spaces inserted when it was pasted, because DKIM keys are long and many DNS interfaces wrap or split them awkwardly.
What it breaks
Receivers cannot load the public key, so every signature made with this selector fails verification.
How to fix it
Re-paste the key exactly as your provider issued it.
- Copy the record value again from the provider's console.
- Paste it as a single unbroken value. If your DNS host requires splitting long strings, use its quoted-string syntax rather than inserting spaces.
- Verify the p= value is unbroken base64 with no whitespace inside it.
- Re-check the selector.
Specification: RFC 6376 — DomainKeys Identified Mail
Related problems
- No DKIM key found at the selectors we checkedWe probed the selectors used by common providers and found no DKIM record.
- DKIM key is shorter than 1024 bitsThe RSA key is too short to be considered secure and some receivers reject it.
- No DMARC record foundThere is no DMARC policy at _dmarc for this domain.
- DMARC record contains a syntax errorA tag in the DMARC record is malformed, which can invalidate the whole policy.
- More than one DMARC record publishedMultiple DMARC records exist at _dmarc, so receivers ignore the policy entirely.