# DKIM not validating

> DKIM fails when a selector TXT is missing, truncated, still propagating, or looking up against the wrong nameserver. EmailPal publishes rsa._domainkey and ed._domainkey and re-checks both on public resolvers.

Source: https://emailpal.io/help/dkim-not-validating

## What the error means

A receiver (or our dashboard) looked up the DKIM TXT for a selector on your domain and did not get a key that matches the signature on the message.

## Fix it in order

1. **Wait if you just published.** DNS can lag. EmailPal re-verifies; a red check that turns green without you touching anything was propagation.
2. **Confirm both selectors exist.** `rsa._domainkey.yourdomain.com` and `ed._domainkey.yourdomain.com`. Missing one selector is the usual BYO copy-paste miss.
3. **Do not split the TXT.** Some registrars wrap long RSA keys badly. Paste the dashboard value as one record.
4. **Look it up off the registrar.** `dig` or a public lookup against 1.1.1.1 / 8.8.8.8. The registrar UI lying is why we re-verify publicly. See [DNS verification failed](/help/dns-verification-failed).
5. **CNAME vs TXT.** If you CNAME'd the selector to a host that does not serve the key, validation fails. Use the record type the dashboard asks for.

## Pre-warmed and EmailPal-registered domains

You should not be editing DKIM at all. If a hosted domain shows DKIM red, it is on us — [open a ticket](/help/open-a-support-ticket).

## FAQs

### Instantly says "DKIM not found" on an EmailPal domain

Instantly's domain test looks for *their* selector, not ours. If you connected an EmailPal mailbox to a sequencer, authenticate as EmailPal documents, not as Instantly's DFY wizard. The sending domain's DKIM is the one on EmailPal.

### Can I ignore Ed25519 if RSA passes?

Leave both. Receivers pick what they understand.

## Need more help?

[What is DKIM](/help/what-is-dkim) and [SPF, DKIM, DMARC and MX](/help/spf-dkim-dmarc-and-mx).