MailFixIt

Cloudflare DNS and DKIM

Cloudflare DKIM CNAME not verifying: check DNS Only and CNAME flattening

Your mail provider gives you a DKIM selector and CNAME target. Cloudflare must publish that exact CNAME. Verification can fail when the name or target is wrong, the record is proxied, or CNAME flattening hides it.

Before you start

Get these two values from your mail provider's DKIM setup page:

  • Selector: the part before ._domainkey, for example selector1.
  • CNAME target: the provider hostname that the record must point to.

Cloudflare can show an existing selector, but it cannot tell you which selector your mail provider intended if the record is missing.

Run this automated test on my domain

Enter your domain. MailFixIt checks the relevant DNS records automatically and shows the evidence.

Check the record in Cloudflare

  1. Open Cloudflare DNS Records. Sign in and select the domain if asked.
  2. Search for selector._domainkey, using your actual selector.
  3. Confirm the type is CNAME and the target exactly matches the value from your mail provider.
  4. Set Proxy status to DNS only. If the record has a Flatten option, turn it off.
  5. Save the record and run the MailFixIt check again.

If the CNAME is still not public

Open Cloudflare DNS Settings and find CNAME flattening. If flattening for all CNAME records is enabled, review the other CNAMEs in the zone before turning it off. This is a zone-wide setting.

A missing public CNAME does not prove that flattening is the cause. Also check that Cloudflare is authoritative for the record name and that no NS record delegates this subdomain to another DNS provider.

If DNS returns an IP address

Do not replace the DKIM CNAME with an A or AAAA record. An address response can mean that Cloudflare proxied or flattened the CNAME. The mail provider still needs the CNAME it supplied.

Finish verification

After the CNAME is publicly visible, return to your mail provider and start its DKIM verification again. Then send a new message and confirm that its DKIM-Signature header uses the expected selector.

Frequently asked questions

Can Cloudflare CNAME flattening break DKIM verification?

Yes. A mail provider may need to see the CNAME itself. Cloudflare documents that proxying or flattening can return an address instead, which can prevent verification.

Does a missing public CNAME prove Cloudflare flattening is enabled?

No. The record may be missing, use the wrong name or target, exist at another DNS provider, or still be propagating. Check the saved Cloudflare record before changing flattening.

Should DKIM records be proxied through Cloudflare?

No. Set a DKIM CNAME to DNS only so the mail provider can read the CNAME target it supplied.

Where do I find the DKIM selector?

Get it from your mail provider’s DKIM setup page. It is the part before ._domainkey in the record name. If DKIM signing already works, it also appears after s= in the DKIM-Signature message header.

Related email diagnostics

DNS record not detected after saving the provider-issued valueDiagnose a DNS record that is not detected after saving it. Compare the exact TXT, CNAME or MX value, identify a duplicated hostname, and avoid unsafe DNS changes. DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key.

Primary sources: Cloudflare: Verify a domain with CNAME, Cloudflare: Set up CNAME flattening, Cloudflare: Manage DNS records.