Selector and DNS record The DKIM selector resolves to a published TXT record No record means no valid signature, full stop 2. DMARC alignment The d= domain in the signature matches the From: domain Misalignment fails DMARC even with a valid DKIM signature 7. If the record looks correct on inspection but authentication still fails, paste the raw record into a DKIM record validator rather than checking it by eye. Confirm DKIM alignment with your DMARC policyA valid DKIM signature is not the same as DKIM alignment, and this distinction trips up a lot of otherwise correct setups. Any DKIM key still using 1024-bit should be rotated to 2048-bit as a priority rather than left in place until the next scheduled review.