Identify the service that signs your mail
Take the DKIM selector and public record from the service that sends the message, then verify a newly signed message.
The sending service holds the DKIM private key; DNS publishes the matching public key. Enable signing there and copy its exact selector, hostname and record. Different senders may need different selectors. A DirectAdmin key will not authenticate mail sent solely by another provider.
Publish the selector
- Find the authoritative DNS provider and inspect existing TXT or CNAME records at the proposed selector.
- Create the record type specified by the sender. A TXT name typically resembles
selector1._domainkey.example.com;selector1and the domain here are placeholders. - Paste the full public value without extra quotation marks unless the DNS interface adds them automatically. Long TXT values may be displayed as several quoted strings; that alone does not mean the key is broken.
- Check the public record with
dig TXT selector1._domainkey.example.com, replacing the example with the real name. Activate signing in the sending platform if that is a separate step.
Test a real message
Send from each platform to a mailbox that exposes full headers. Check dkim=pass, the signing domain (d=) and selector (s=). For DMARC, the signing domain must align with the visible From domain. A published record without a signature proves only DNS publication, not that outbound mail is signed.
For example, a message signed as d=example.com; s=outbound1 should lead to a public key at outbound1._domainkey.example.com and a receiving result of dkim=pass; the DNS answer alone is insufficient.
Common failure points
A missing record often means the wrong DNS zone or a duplicated domain suffix in the record name. A failed signature can follow message modification after signing or a stale key. Rotate keys in the sending service first, publish its replacement, verify it, then retire the old selector according to that service's instructions. The domain owner manages DNS access; the sender controls signing and the private key. Never send private key material in a support ticket.
Find the selector and the live DNS location
A selector is the s= value in a DKIM-Signature header. The signing domain is d=. Together they identify a DNS name of the form selector._domainkey.signing-domain. For a new service, the provider should supply the selector before mail is sent; for an existing service, inspect a recently delivered message's full headers. A message may carry more than one DKIM signature, so identify the signature from the service you are configuring.
Example: DKIM-Signature: d=example.com; s=outbound1; ... points to outbound1._domainkey.example.com. Query that exact name with dig TXT outbound1._domainkey.example.com +noall +answer. If the provider requires a CNAME rather than TXT, query CNAME first and follow its target. The selector, domain and target here are illustrative; copy the live provider's instructions.
Diagnose publication versus signing
| Finding | Meaning | Action |
|---|---|---|
| NXDOMAIN at the exact selector name | That name does not exist in the queried DNS view | Check the observed s= and d=, current delegation, selector spelling and whether the panel appended the domain twice. |
| The name exists, but no intended TXT key is returned | The record may be absent, at another name or published as a provider-specified CNAME | Query TXT and CNAME at the exact name, compare with the actual sender's instructions and ask the authoritative DNS owner to correct only the affected record. |
| SERVFAIL, timeout or inconsistent answers | DNS resolution has not provided a reliable key answer | Check the authoritative nameservers and DNS health before treating this as a missing selector; allow existing cached answers to expire after an authorised change. |
| DNS key exists, no DKIM-Signature header | The tested sender may not be signing | Enable authentication in that sending platform if authorised; test the same sending route again. |
dkim=fail with a reachable key | Signature or key verification failed | Compare d= and s= with DNS; ask the sender to check key rotation and downstream message modification. |
dkim=pass, dmarc=fail | The signing domain may not align with the visible From domain | Ask the sender to sign with an aligned domain or check SPF alignment. |
Some DNS panels show long TXT records as multiple quoted chunks within one record; DNS concatenates those strings. Multiple separate TXT records at one selector name are a different configuration and can make verification undefined. Compare the returned key with the sending service before deleting or replacing any record.
Rotate a key without a gap
If a key must change, obtain a new selector from the sending service, publish its new DNS record and verify it at authoritative nameservers. Switch signing to the new selector, test real outbound messages, then retain the old public key long enough for messages already in transit to be checked according to provider guidance. Retire it only after that interval. Never send a private DKIM key to Novasean or put it in DNS. With several senders, repeat the check for each platform; a successful signature from one does not prove the others work.
DirectAdmin with external DNS
When DirectAdmin sends mail for the domain and its user-level DKIM option is available, the E-mail Accounts area can enable signing. First confirm that DirectAdmin is the actual outbound sender. Then identify the generated selector and public TXT value in DirectAdmin DNS Management. If the domain is delegated to external nameservers, copy the public TXT record into that authoritative zone; enabling signing in DirectAdmin does not publish it there. Query the exact selector at the delegated nameserver, then send a new message from that same DirectAdmin path and check its receiving authentication result before considering the task complete.
Do not toggle DKIM repeatedly to fix a missing external record. A new key may invalidate a previously copied value. If the button is absent or the server does not sign, ask Novasean support to check whether the feature is enabled for this service. Server-level Exim and DirectAdmin configuration belongs to the hosting operator, not to a shared-hosting customer. If mail is sent through another provider, use that provider’s key and selector instead of DirectAdmin’s. This distinction prevents a locally correct but publicly unfindable key from causing DKIM failures.
Common questions
Can I copy a DKIM record from another domain? No. Follow the sender's per-domain setup and selector instructions.
Does an MX record choose the DKIM key? No. MX controls inbound delivery; the outbound service signs messages.
Does a valid key prove every message is signed? No. Inspect a new message from each sending platform.
Sources and technical references
Related guides
Was this guide helpful?
If you accepted optional analytics, your Yes/No answer and this guide’s page address are sent to Google Analytics. No written feedback is collected. Read our privacy statement or change your choice in .
Need help with your service?
Open your client area or contact Novasean. Describe the symptom and checks you have performed. Keep passwords, recovery codes and private keys out of your message.