I set up DKIM, but the source still fails
On every plan
Check four things, in this order: whether the reports cover the days after your change yet, whether the service still signs with its own domain, whether the key in DNS matches the service's, and whether your DMARC record asks for strict alignment. The Explanation for the source on the Sources page tells you which one applies.
The reports still cover the days before
Google and Microsoft send one report a day, about mail from a day already past. Mail you send after the change appears in a later report.
The Sources page shows totals for the date range chosen at the top of the page. It shows the explanation that covers most of the source's mail in that range, and the source counts as fine only when 98 percent of its mail passes. Days from before your change stay in the range, so a source can stay flagged after a fix that worked. Its DKIM column then shows the share of its messages that aligned, such as "aligned for 93 %", rounded down so that only all of them reads "aligned".
To see the days since the change, choose a shorter range, or open the source. Its page charts each day and lists its most recent records, each with the date and whether it passed DMARC.
The service still signs with its own domain
If the explanation says DKIM is signed by the service's domain, the service does not sign this mail with yours yet. Mailchimp signs with mcsv.net, HubSpot with hubspotemail.net and Microsoft 365 with onmicrosoft.com until you set up DKIM for your own domain in the service.
Set it up for every domain the source sends mail for. The source's page lists those domains, and links the service's playbook where there is one.
If the explanation says the service cannot sign mail with your domain, its own pages describe no setting for it. When the service cannot sign for your domain lists what you can do instead.
The key in DNS is missing or wrong
If the explanation says DKIM is signed with your domain but the signature does not verify, the key in DNS is missing, old, or not the one the service signs with. A service that has rotated its key looks exactly like this.
On the DNS tab, the DKIM card shows the selectors we know for the domain, including those seen in reports. It says when a selector's key is missing or cannot be read as a DKIM key. Compare the record your service shows now with the one in DNS, and publish the service's current value. If the service gives you a CNAME record, delete any TXT record at the same name: a CNAME cannot share its name with another record.
Your record asks for strict alignment
With adkim=s in your DMARC record, the DKIM domain has to be exactly the From domain. A service that signs as mail.example.com for mail from example.com then fails, though it passes under the default, relaxed rule.
The DMARC card on the DNS tab flags strict alignment. Unless you chose it on purpose, remove adkim=s with the record builder on the domain's Records tab, and publish the new record.
After a fix
Press Check now on the DNS tab, so the tab reads DNS again. The report for the first whole day after the fix shows whether it worked.
Published 27 October 2026 · Checked 27 October 2026