Mail errors · SPF, DKIM and DMARC results

What does “PERMFAIL (no key for signature)” mean?

The DKIM key named in the signature was not found in your DNS.

Last read from the sources at the foot of this page.

Check my firm Read the steps
Result
DKIM check

PERMFAIL (no key for signature)

As the standard prints it.
01

What does it mean?

Each signature names a selector (s=) and a domain (d=). The checking server looks for the key at selector._domainkey.domain and found nothing there.

02

What exactly does the source say?

If the query for the public key fails because the corresponding key record does not exist, the Verifier MUST immediately return PERMFAIL (no key for signature).

03

Why would a small firm see it?

The record was never published, was published at the wrong name, or carries the domain twice because the DNS host adds it for you.

04

How do I fix it?

  1. Open the headers of a sent message and read the s= and d= values in the DKIM-Signature line.
  2. Look up the TXT or CNAME record at s-value._domainkey.d-value.
  3. If it is missing, publish it as the service shows it.Leave your domain off the name if your DNS host adds it.
05

What else do the sources say?

dkim=<pass|fail (reason)|none> header.d=<domain>

provide the TXT record name as zoho._domainkey

Sources

Where does this come from?

Related
07 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy