DKIM not found: selector, publishing the key and checking

What's wrong

DKIM signs mail with the domain's key; receivers verify the signature with the public key in DNS at <selector>._domainkey.example.com. If the record is missing or the selector is wrong, the signature can't be verified and forwarded mail fails DMARC.

Finding the selector

Open the source of any sent message and find the DKIM-Signature header: s= is the selector, d= the domain. Typical ones: Google — google, Microsoft 365 — selector1/selector2, Yandex 360 — mail.

How to fix

1. Enable DKIM in your mail provider's panel and copy the record.
2. Publish it (TXT or CNAME — whatever the provider gives):

mail._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."

3. A 2048-bit key doesn't fit one TXT string — split it into 255-character chunks; most DNS panels do this for you.
4. Verify in Email DNS Checker with the selector.

Use 2048-bit keys; 1024 bits is considered weak.