DKIM public-key diagnostics
DKIM public key record is invalid or revoked
A DKIM selector must resolve to a usable public key in DNS. Check the exact selector and signing domain before replacing a record: copying a guessed key can break a working sender or publish credentials for the wrong service.
A DKIM verifier reports the following DNS problem:
DKIM public key record is invalid or revoked.
Run this automated test on my domain
Enter your domain. MailFixIt checks the relevant DNS records automatically and shows the evidence.
What the check can confirm
- Revoked key: an empty
p=value intentionally revokes that selector. - Invalid key: the record is malformed or does not contain a usable public-key value.
- Unsupported key: the published key type cannot be evaluated safely by this checker.
- Missing selector: the selector does not resolve to a public DKIM key at the checked name.
Safe repair workflow
- Get the exact selector, signing domain and public-key or CNAME target from the sending service.
- Check the current record and any CNAME target in public DNS.
- Replace or restore only the provider-issued value for that selector; preserve unrelated selectors and TXT records.
- Send a new test message and inspect its complete headers after DNS has propagated.
A present DNS key is not proof that a message passed DKIM. Verification also needs the original signed message. An empty p= is an intentional revocation, so restore a key only when the sending service still uses that selector.
Frequently asked questions
What makes a DKIM public key invalid?
A DKIM record can be invalid when it is malformed, lacks a usable public-key value, uses an unsupported key type, or conflicts with another record. An empty p= value specifically revokes the key.
Does a valid DKIM DNS key prove my mail passes DKIM?
No. Public DNS can confirm the published key state only. Verifying a particular DKIM signature also requires the original signed message and its canonicalization inputs.
Related email diagnostics
Primary sources: RFC 6376 DKIM.