An alert says a DKIM key is missing

On every plan

The DKIM key missing alert means that a selector which signed mail from your domain in the last 30 days has no DKIM key in DNS now. Mail signed with that selector fails DKIM until the key is back. Find the service that uses the selector and publish its current key again. If you stopped using that service on purpose, there is nothing to fix, and the alert clears by itself.

What the alert checks

Each DKIM key sits in DNS at <selector>._domainkey.<domain>. We learn which selectors your domain uses from your reports, and every DNS check looks each one up.

The alert opens when a report showed the selector signing for your domain, or for a subdomain of it, in the last 30 days, and that name now has no key. It names the selector, the domain it signs for and the day a report last showed it. Its link opens the domain's DNS tab.

It starts on for every domain, on every plan. An admin can turn it off on the domain's Alerts page. We look for it after every DNS check.
A name that answers with a TXT record we cannot read as a key gets another finding, cannot be read as a DKIM key, and no alert.
A signature with a sending service's own domain, such as mcsv.net, is not looked up. That key belongs to the service.

Mail signed with the missing key can still pass DMARC if its SPF passes and aligns with your domain. Forwarded mail loses SPF, so forwarded mail from that service then fails.

The usual causes

The sending service moved to a new selector, and the old selector's record was deleted. Reports from before the switch still show the old selector, so the alert stays open until no report has shown it for 30 days.
Someone deleted the record while tidying DNS. It is often a CNAME that pointed to the service.
The domain moved to another DNS host, and the DKIM records were not copied across.
A CNAME still points to the service, but the service no longer publishes a key there, for example after the account was closed. We follow the CNAME, and find nothing at the end of it.

Find the service

Open the domain's DNS tab. The DKIM card lists the selector, where we learned of it, and the first and last day a report showed it. Its status says there is no key.
On the Reports page, open a report from that last day. Each record in it opens with Explain to show its authentication results, including every DKIM signature and its selector. The record names its source.

Publish the key again

In the service, open its DKIM settings and copy the record it shows now.
Publish that record in your DNS, at the name the service gives and with the value exactly as shown. If the service gives a CNAME, delete any TXT record at the same name.
Press Check now on the domain's DNS tab. The DKIM card then shows a key for the selector, and the alert clears.

If the service now signs with a different selector, publish the record for that one. The old selector stops counting once no report has shown it for 30 days. The guide Check a DKIM key in DNS compares the two records step by step.

If you stopped using the service

If the selector belonged to a service you no longer send through, removing its key was right. The alert stays open until no report has shown the selector for 30 days, then clears by itself. After 90 days without a report, the DNS tab moves the selector to its list of retired selectors, and we go on checking it.

If reports still show the selector signing after you stopped, something still sends your mail through that service. The record in the report names the source.

Published 27 October 2026 · Checked 27 October 2026