No DKIM signature on your emails

What it means

DKIM (DomainKeys Identified Mail) adds an invisible digital signature to every email you send. Receivers check it with a public key published in your DNS. If it matches, they know the email really comes from your domain and was not changed on the way.

Your test email arrived with no DKIM signature at all.

Why it matters

• Gmail and Yahoo require DKIM for bulk senders, and strongly prefer it for everyone.
• DKIM survives forwarding, unlike SPF. It is often what makes DMARC pass.
• Without it, your emails look less trustworthy and are more likely to go to spam.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page, copy your unique test address, send it a normal email from the mailbox you want to check, then open the report. The DKIM line says "not signed" when no signature is found.
• Use the Domain scanner: type your domain at /domain-scanner to read your DNS records without sending anything.

The Domain scanner looks for DKIM keys on the usual names (called "selectors"), like google, selector1 or default. A key can be published while signing is still switched off, so the test email is the real proof.

How to fix it

DKIM is always a two-part job: turn on signing in the service that sends your emails, and publish the public key in your DNS.

Google Workspace

1. In the Admin console, go to Apps, Google Workspace, Gmail, Authenticate email.
2. Generate a new record (choose 2048-bit if your DNS provider accepts long values).
3. Add the TXT record it shows, with the name google._domainkey.
4. Wait until it is visible, then click Start authentication.

google._domainkey.yourdomain.com  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...(long key)..."

Microsoft 365

1. In the Microsoft Defender portal, open Email authentication settings, then DKIM.
2. Select your domain. Microsoft shows two CNAME records, selector1._domainkey and selector2._domainkey.
3. Add both CNAME records at your DNS provider, exactly as shown.
4. Come back and switch on "Sign messages for this domain with DKIM signatures".

selector1._domainkey.yourdomain.com  CNAME  (value shown by Microsoft)
selector2._domainkey.yourdomain.com  CNAME  (value shown by Microsoft)

Web hosts, newsletter tools and other services

Look for a setting called "DKIM", "domain authentication" or "authenticate your domain". The service gives you one or more records (TXT or CNAME) to copy into your DNS. Every service that sends email in your name needs its own DKIM setup.

Common mistakes

• Some DNS providers add your domain automatically. If you type google._domainkey.yourdomain.com as the name, it can become google._domainkey.yourdomain.com.yourdomain.com. Type only google._domainkey.
• Long keys can get cut or broken by extra spaces when copied. Paste the value in one go.
• Publishing the key is not enough: signing must also be switched on.

Check that it is fixed

DNS changes are not instant. Most are visible within a few minutes, but some providers take up to 24 to 48 hours.

Run the Domain scanner to see the key, then send a new test email from the home page. The report should show a valid DKIM signature from your own domain.

Provider help: Google Workspace DKIM and Microsoft 365 DKIM.