DKIM record found

What this means

Passing means a DKIM public key resolves under _domainkey on your domain at one of the selectors common providers use, so receivers can verify that mail signed as you was really sent by your provider. Failing means we found no key at any of those selectors: either no DKIM is published, or your provider uses a selector we do not probe. In the second case, check your own selector with dig and you can treat the result as a pass.

How we test it

We run a TXT lookup at resend, google, default, k1, selector1 and s1 under _domainkey.YOUR_DOMAIN. Any selector returning a record containing p= is a pass. No record at any of them is a fail; there is no warn state. This is a passive check.

Why it matters

Without DKIM, transactional mail lands in spam. DKIM is also what DMARC aligns on, so without it your DMARC policy has nothing to pass. The Module 08 notes are blunt about how this breaks: paste the DKIM value one character off and DKIM silently fails, mail still sends, and it lands in spam. The other common cause is the host entered with the domain appended twice, so the key sits at resend._domainkey.YOUR_DOMAIN.YOUR_DOMAIN where no receiver looks.

The fix

In Resend, Domains, Add Domain, copy the TXT value it shows for resend._domainkey and paste it whole into Cloudflare DNS with only resend._domainkey in the Name field (Cloudflare appends the zone), DNS only, then click Verify in Resend. Confirm with dig +short TXT resend._domainkey.YOUR_DOMAIN returning a line that starts p=.

The full runbook is in the Fix Kit, Module 08.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change any DNS record. For each selector in: resend google default k1 selector1 s1
run dig +short TXT SELECTOR._domainkey.YOUR_DOMAIN and show me every output, including the empty ones.
Tell me which selectors returned a record containing p= and which returned nothing.
Find the sending provider in the codebase: grep -rniE "api\.resend\.com|smtp\." --exclude-dir=node_modules . | head, and name it.
If that provider uses a selector not in the list, run dig for that selector too and show the result.
Check for the double-domain mistake: dig +short TXT resend._domainkey.YOUR_DOMAIN.YOUR_DOMAIN and report whether anything answers there.
Tell me what it would take to publish DKIM for the provider you found, and stop before changing anything.
Finally run: dig +short TXT resend._domainkey.YOUR_DOMAIN | grep -c "p=" and show the count. Expected 1.

Copy the prompt