DKIM “Public Key Not Found” Error

The DKIM "Public Key Not Found" error occurs when a receiving mail server processes an email signed with DomainKeys Identified Mail (DKIM) but cannot locate the matching cryptographic public key in your domain’s DNS. Without this record, the recipient cannot verify the message signature, leading to authentication failure, quarantine, or spam classification. Resolving this requires verifying your DNS TXT record syntax, confirming selector matching, and accounting for propagation delays.

What Causes DKIM “Public Key Not Found”?

A DKIM “Public Key Not Found” error occurs when a receiving mail server queries DNS for the selector record specified in an email’s s= header tag and receives an NXDOMAIN (empty) response. The fix is to publish the correct TXT record at [selector]._domainkey.[domain.com] with the corresponding p= public key data.

Understanding the DKIM Lookup Process

When an email server signs an outbound message using DKIM, it generates a hash of the message contents and encrypts that hash using a private key. It then attaches a DKIM-Signature header to the email.

This signature header contains several key tags:

• v=1: The DKIM specification version.
• a=rsa-sha256: The algorithm used to generate the signature.
• d=example.com: The signing domain.
• s=google: The selector used to locate the public key.
• b=...: The actual cryptographic signature.

When the receiving server receives this message, it constructs a DNS TXT lookup query:

[selector]._domainkey.[signing-domain]

For example, if s=google and d=example.com, the receiving server requests the TXT record for google._domainkey.example.com.

If that query returns no record (NXDOMAIN or an empty result), the receiver flags the email with dkim=neutral (no key for signature) or dkim=permerror (public key not found). This drops your domain authentication score and exposes the message to anti-spam rejections.

Incoming Email Header:
  d=example.com
  s=2026mail
        │
        ▼
Receiving Server constructs query:
  "2026mail._domainkey.example.com"
        │
        ▼
DNS Lookup Execution
  ├── Record Found: Validates signature with public key (PASS)
  └── Record Missing / NXDOMAIN: "Public Key Not Found" (PERMERROR)

Common Diagnostic Causes

1. Selector Mismatch

The selector defined in your email platform (Google Workspace, Microsoft 365, SendGrid, Mailchimp) must match the host name of your DNS record. If your outbound email signs with s=2026mail, but the DNS record was published as google._domainkey.example.com, the lookup will fail.

2. Incorrect DNS Record Name (Domain Duplication)

When creating DNS records, many hosting control panels (such as cPanel, GoDaddy, or Cloudflare) automatically append your domain name to the entry field. If you enter google._domainkey.example.com into the name field, the DNS server may publish it as:

google._domainkey.example.com.example.com

This causes receiving servers querying google._domainkey.example.com to receive an NXDOMAIN response.

3. DNS Propagation Delays

New DNS records or updates can take time to propagate globally depending on Time To Live (TTL) values. If you turn on DKIM signing in your administrative console before the DNS change has propagated, receiving servers will immediately encounter missing keys. See How to Fix DNS Propagation Lag for New Domains.

4. Premature Key Revocation During Rotation

If an administrator generates a new DKIM key and deletes the old DNS TXT record immediately, any messages that are in transit or queued by downstream MTAs will fail DKIM verification when delivered.

Step-by-Step Diagnostic and Resolution Procedure

Follow these steps to locate and resolve the missing key error:

Step 1: Extract the Selector and Domain from the Raw Header

Open the bounced email or check the header using How to Read Gmail “Original Message” Headers. Locate the DKIM-Signature line and identify the s= and d= values.

Example:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
    d=example.com; s=google;
    h=to:subject:message-id:date:from:mime-version;
    bh=w7...=;
    b=k9...==

Here, the selector is google and the domain is example.com.

Step 2: Query the DNS Record Directly

Run a command-line DNS query using dig or nslookup:

dig txt google._domainkey.example.com +short

Evaluate the output:

• Empty output or NXDOMAIN: The record is missing or misnamed in your DNS provider.
• Output displayed: If a record appears, check if your provider requires a subdomain prefix or if a secondary nameserver is out of sync.

Step 3: Re-publish the Public Key TXT Record

If the record was missing or misnamed, log in to your DNS management console and add the record:

• Record Type: TXT
• Host / Name: google._domainkey (or the specific selector chosen)
• Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
• TTL: 300 seconds (5 minutes) or 3600 seconds (1 hour) during troubleshooting.

If you manage your domain through third-party DNS hosting that supports CNAME flattening or proxies, ensure the key string is not altered. See How to Correct CNAME Flattening Issues for DKIM.

Step 4: Validate in Your Admin Console

After verifying through command-line queries that the DNS record is resolving correctly across external resolvers (such as 8.8.8.8 or 1.1.1.1), enable DKIM signing in your management dashboard. In Google Workspace, navigate to Apps > Google Workspace > Gmail > Authenticate email, select the domain, and click Start Authentication.

If the signature still generates errors after successful publication, consult Resolving “Message not authenticated by DKIM”.