DKIM public-key diagnostics

Fix an invalid DKIM public key record

A DKIM selector must resolve to a usable public key in DNS. Check the exact selector and signing domain before replacing a record: copying a guessed key can break a working sender or publish credentials for the wrong service.

Problem description

A DKIM verifier reports the following DNS problem:

DKIM public key record is invalid or revoked.

Check the DKIM selector free

What the check can confirm

Revoked key: an empty p= value intentionally revokes that selector.
Invalid key: the record is malformed or does not contain a usable public-key value.
Unsupported key: the published key type cannot be evaluated safely by this checker.
Missing selector: the selector does not resolve to a public DKIM key at the checked name.

Safe repair workflow

Get the exact selector, signing domain and public-key or CNAME target from the sending service.
Check the current record and any CNAME target in public DNS.
Replace or restore only the provider-issued value for that selector; preserve unrelated selectors and TXT records.
Send a new test message and inspect its complete headers after DNS has propagated.

A present DNS key is not proof that a particular message signature passed. Signature verification also needs the original signed message. Technical reference: RFC 6376 DKIM.