Fix guide 2 min read

DKIM signature missing or failing

How to fix missing DKIM signing for the exact message path used in a placement test.

By Sendlander editorial team Published August 20, 2026 Last reviewed August 20, 2026 Technical review: Sendlander deliverability team

Use the steps for your setup.

Publish the key your real sending platform provides, enable signing there, and prove a new message has dkim=pass.

Finding: AUTHENTICATION.DKIM
Reviewed: 2026-08-21

Before you change anything: A DKIM record in DNS is not enough by itself. The platform that sends the message must also sign it with the matching private key.

1. Fix it in the sending platform

Where was the failed email sent from?

Google Workspace

Generate a key in Google Admin, publish it in DNS, then explicitly start authentication.

1
In Google Admin, open Apps → Google Workspace → Gmail → Authenticate email and select the sender domain.
2
Generate a 2048-bit record where supported and copy Google's TXT host and value into DNS.
3
After the record resolves, return to Authenticate email and start authentication for the domain.

Open the official instructions

2. Publish the DNS records

Where is this domain's DNS managed?

Cloudflare

Publish the exact record supplied by your sending platform in Cloudflare DNS.

1
Open the domain in Cloudflare, then go to DNS → Records and choose Add record.
2
Choose the record type shown by your sending platform and paste the supplied name and value exactly.
3
For email-authentication CNAME records, use DNS only rather than the orange-cloud proxy, then save.

Open the official instructions

3. Prove DKIM is fixed

Verify the delivered message, not only the DNS screen.

1
The selector in the new DKIM-Signature resolves to the public key in DNS.
2
The delivered Authentication-Results header says dkim=pass.
3
The signing domain is the domain you intended to authenticate, then a fresh Sendlander test no longer reports this finding.

Run the verification test

Why this matters

DKIM lets the receiving provider verify that the message was authorized by the sending domain and was not modified in transit.

A DNS record alone is not enough. The delivered message must actually include a passing DKIM signature for the sender or signing domain you expect.

How to fix it

Enable DKIM in your ESP, CRM, SMTP provider, or mailbox provider. Publish the selector TXT or CNAME record exactly as that provider gives it.

Send another test through the same system and confirm the delivered headers show dkim=pass before treating the issue as resolved.