DNS and authentication

DKIM not validating

DKIM fails when a selector TXT is missing, truncated, still propagating, or looking up against the wrong nameserver. EmailPal publishes rsa._domainkey and ed._domainkey and re-checks both on public resolvers.

What the error means

A receiver (or our dashboard) looked up the DKIM TXT for a selector on your domain and did not get a key that matches the signature on the message.

Fix it in order

Wait if you just published. DNS can lag. EmailPal re-verifies; a red check that turns green without you touching anything was propagation.
Confirm both selectors exist. rsa._domainkey.yourdomain.com and ed._domainkey.yourdomain.com. Missing one selector is the usual BYO copy-paste miss.
Do not split the TXT. Some registrars wrap long RSA keys badly. Paste the dashboard value as one record.
Look it up off the registrar. dig or a public lookup against 1.1.1.1 / 8.8.8.8. The registrar UI lying is why we re-verify publicly. See DNS verification failed.
CNAME vs TXT. If you CNAME'd the selector to a host that does not serve the key, validation fails. Use the record type the dashboard asks for.

Pre-warmed and EmailPal-registered domains

You should not be editing DKIM at all. If a hosted domain shows DKIM red, it is on us — open a ticket.

FAQs

Instantly says "DKIM not found" on an EmailPal domain

Instantly's domain test looks for *their* selector, not ours. If you connected an EmailPal mailbox to a sequencer, authenticate as EmailPal documents, not as Instantly's DFY wizard. The sending domain's DKIM is the one on EmailPal.

Can I ignore Ed25519 if RSA passes?

Leave both. Receivers pick what they understand.

Need more help?

What is DKIM and SPF, DKIM, DMARC and MX.