Cloudflare DNS and DKIM

Cloudflare DKIM CNAME not verifying

A sending provider may require a public CNAME at a DKIM selector. If Cloudflare flattens that CNAME, the provider can be unable to read the record it expects. Start by comparing the exact issued CNAME; do not assume flattening is the cause.

Check the DKIM CNAME free

Use the provider's exact value. Enter the DKIM selector owner and CNAME target supplied by the sending provider. MailFixIt reports whether that CNAME is publicly observable; it does not log into Cloudflare or change a DNS setting.

Safe troubleshooting order

Confirm Cloudflare is the authoritative DNS host for the domain, not just the registrar.
Copy the issued selector._domainkey owner and CNAME target again.
Compare the public CNAME. A mismatch or absence means the expected CNAME is not observable, not that flattening is proven.
In Cloudflare DNS, inspect the matching record and relevant flattening settings. If the provider requires the CNAME, follow Cloudflare's DNS-only/flattening guidance for that record.
Recheck public DNS, then refresh verification at the sending provider and validate a new message header after signing is enabled.

Do not use an A record as a DKIM substitute

DKIM providers that request a CNAME need their specified CNAME chain. A returned address can be evidence that the CNAME is being flattened, but it is not a replacement for a provider-required CNAME.

Official reference: Cloudflare email DNS troubleshooting.