Fix DKIM s= Selector 404 Error

Why Is Your DKIM s= Selector DNS Record Returning 404?

You’re running a bulk email verification, and it’s flagging dozens of valid addresses as invalid. You check the sender’s domain, the SPF records are fine, DKIM seems set up—but then you see it: a 404 error when querying the DKIM s= selector DNS record.

That’s not a server fault. It’s a missing or misconfigured DNS entry. A 404 on a DKIM TXT record means the domain doesn’t have the expected TXT record at the specific subdomain path (like default._domainkey.example.com). This breaks authentication and causes verification engines—like MailTester—to reject even valid addresses.

If your email infrastructure relies on DKIM for sender reputation, this is more than a technical hiccup. It’s a deliverability time bomb.

Key takeaways

A 404 on a DKIM s= selector DNS record means the DNS lookup finds no record at the expected subdomain path, breaking email authentication.
Even valid email addresses may fail verification if the DKIM TXT record is unreachable due to a missing or misconfigured DNS entry.
Common causes include incorrect subdomain syntax, wrong selector value, or a misaligned domain configuration in your email provider’s setup.

How Does a DKIM s= Selector Work in Email Verification?

When MailTester or another email verifier checks an address, it looks up the DKIM s= selector—like s1—to find the public key published in DNS at s1._domainkey.example.com. If that TXT record returns a 404, the signature can’t be validated, and the email is flagged as risky or invalid, even if the address exists. You can’t verify DKIM without a working lookup.

DNS Lookup: The First Step in Verification

Here’s how MailTester checks DKIM during verification:

Extract the DKIM signature’s selector from the email header. This is the s= value, like s1 or default. You might see it in the header as dkim=pass (signature verified) with a selector tied to the sending domain.
Construct the DNS query using the format s.selector._domainkey.domain.com. For a domain example.com with selector s1, the lookup target is s1._domainkey.example.com. This path has to be exact.
Request the TXT record from DNS. The system queries the authoritative DNS server for that subdomain. If the record doesn’t exist or returns a 404, verification fails at this step, even if the email address is valid.
Fetch the public key published in that TXT record. The key is used to verify the cryptographic signature in the email header. Without it, validation is impossible.
Verify the signature using the retrieved public key. If the math checks out, the email likely comes from the claimed domain, and the address is not forged or spoofed.

The 5 steps described in “DNS Lookup: The First Step in Verification”, in order.

If your sender domain uses DKIM, but the s= record returns 404, you’ve likely misconfigured DNS. That’s why MailTester reports “DKIM validation failed” or “record not found”—not because the address is fake, but because the cryptographic proof is missing.

What You Can Do (Beyond Fixing DNS)

If you’re troubleshooting a 404 on a DKIM s= selector, use tools like MXToolbox or RFC 6376 to validate your DNS setup. Ensure the TXT record is published at the correct subdomain and not wrapped in double quotes or truncated.

When sending in bulk, pre-verify your list with MailTester’s bulk verification to catch missing DKIM records early. This stops delivery issues before they reach your inbox.

Remember: a valid email address isn’t enough. If the DKIM signature isn’t verifiable, your reputation still suffers. MailTester’s real-time verification API checks DNS records, syntax, deliverability, and more in a single call—before you send.

What Happens When the DKIM Record Returns 404?

If your DNS TXT record for DKIM with a specific selector returns a 404 error, email verification services can’t confirm the digital signature behind messages sent from your domain. This means they can’t verify whether the message was genuinely sent by you, or if it’s been altered in transit. As a result, your domain may be flagged as unreliable, even for valid email addresses. This breaks trust with providers who rely on authentication to prevent phishing and spam.

How Verification Services Respond to Missing DKIM

When a DKIM selector record is unreachable or returns a 404, the verification tool cannot validate the cryptographic signature attached to any email from that domain. Without this check, it becomes impossible to confirm authenticity during outbound verification or inbound message analysis. Services like MailTester use this signature as one of several trust signals — when it’s missing, the system leans toward caution.

You might see a 'risky' or 'invalid' verdict on an address that’s perfectly real and deliverable. This isn’t a false positive — it’s a technical reality. A missing or misconfigured DKIM record is a red flag that indicates weak or incomplete domain authentication, which is a known signal to filtering systems.

Impact on Deliverability and Sender Reputation

Domains with missing DKIM records or misconfigured selectors often suffer from poor sender reputation scores. Major email providers like Gmail, Outlook, and Yahoo treat authentication gaps as a sign of potential spam or spoofing risk. Even if the content is clean and your list is well-maintained, lack of DKIM coverage raises red flags during scoring.

Over time, this increases your bounce rate on high-volume sends. ISPs may throttle your volume or move your messages to the spam folder. It’s not just about one email failing — it’s about how the pattern of missing authentication erodes trust across the entire sending ecosystem.

You can test this for yourself by checking your domain’s DKIM setup using tools like MXToolbox or RFC 6376, which outlines the technical requirements for DKIM. Ensure the selector (like s=selector1) is correctly published at selector1._domainkey.yourdomain.com and returns a valid TXT record — not a 404.

If you're sending at scale and want to catch these issues before they hurt deliverability, use MailTester’s bulk verification to scan your entire list and find addresses where authentication fails silently. It helps you clean your data early — before you send.

How to Confirm the DKIM TXT Record Is Missing or Incorrect

You can confirm the DKIM TXT record is missing or incorrect by using a DNS lookup tool to query the exact subdomain your email service uses—like s1._domainkey.example.com. If the response is blank or returns a 404-like error, no valid TXT record exists at that location, meaning DKIM verification will fail. This step is essential to diagnose deliverability issues before assuming the setup is correct.

Step-by-Step DNS Verification

Choose a DNS lookup tool. Use a reliable service like MxToolbox or the dig command in your terminal. These tools access public DNS records directly and don’t rely on cached data.
Query the full DKIM subdomain. Run dig TXT s1._domainkey.example.com (replace example.com with your actual domain and s1 with your actual selector). This returns the exact record published for that selector.
Check for a valid response. A correct setup returns a properly formatted TXT record, usually starting with v=DKIM1; and including a g= and k=rsa key. A blank output or error (like “No such domain”) confirms the record isn’t published.
Validate the selector. The selector (e.g., s1) must match exactly what your email provider (SendGrid, Amazon SES, etc.) configured. A mismatch here is a common cause of 404s, even if the record exists elsewhere.

Beyond the Record: What the Results Mean

A missing or incorrect record means incoming mail servers will reject your emails or mark them as suspicious. Since DKIM proves your domain authorized the message, failing this check harms sender reputation. According to the IETF’s RFC 6376, DKIM verification is an industry-standard mechanism for email authenticity—it’s not optional for high deliverability.

The 4 steps described in “Step-by-Step DNS Verification”, in order.

If you’re testing your configuration, use the MailTester email checker to verify how your sending setup appears to external systems. It doesn’t just check syntax; it simulates real-world validation across major inboxes.

If your DNS record returns 404 or no response, the issue is either a misconfigured selector or failed publishing. Double-check the setup in your email service provider’s dashboard and ensure the record was published to the root zone—not a subdomain or incorrect zone.

Common Causes of a 404 on the DKIM s= Selector TXT Record

If your DKIM s= selector TXT record returns a 404, it usually means the DNS query can't find the record. This often happens due to a typo in the selector name, a missing or expired DNS entry, incorrect domain targeting, or temporary propagation delays after a DNS change. Let's walk through the most common issues and how to fix them.

Typo or Misconfigured Selector Name

Double-check that the selector name (e.g., s=mail) matches exactly what’s in your DKIM DNS record. A common mistake is using s=1 instead of s1—even a single character mismatch breaks the lookup.
Use tools like MXToolbox or DNSChecker.org to verify your record is published correctly across multiple global DNS resolvers.
If you’re using a third-party email service (like SendGrid or Amazon SES), confirm they provide the correct selector format and that you’re not overriding it manually with a typo.

Missing, Expired, or Incorrect DNS Entry

A missing or expired record is often due to forgotten configuration steps or automated DNS changes that were never saved. Check your DNS provider’s dashboard for the TXT record with the correct name (e.g., mail._domainkey.example.com).
Ensure the target domain in the record matches your sending domain. A common error is pointing to test.example.com instead of example.com, especially during staging or testing.
Some DNS providers delay record updates. After editing, wait 10–30 minutes and check again using global tools. Propagation delays are normal and don't always reflect server-side failures.

Even if your DNS configuration looks correct, a single missing character, incorrect subdomain, or misaligned selector can cause a 404. It’s easy to overlook these small errors until they impact deliverability. Use MailTester’s email checker to validate the full delivery path—before sending, catch invalid or misconfigured addresses early.

Real-World Example: How a Missing DKIM Record Breaks Verification

You configure DKIM with selector s1, but accidentally publish the TXT record at s1._domainkey.test.com instead of s1._domainkey.example.com. When MailTester checks an email at example.com, it queries the correct DNS record s1._domainkey.example.com. DNS returns a 404 — no record found — so the system marks the domain as unverified, even though the email address is valid. This error causes false negatives in bulk list verification and hurts deliverability because receivers can’t validate your messages.

Why DNS Lookup Fails in Practice

DKIM relies on your domain’s DNS to publish cryptographic keys. The record name must match exactly: selector._domainkey.yourdomain.com. If you misconfigure it — say, by typing test.com instead of example.com — the DNS lookup fails. Even if the key is valid elsewhere, the server won't find it where it's expected. This breaks both sender identity verification and email authentication.

Let’s say your domain is example.com and you set s1 as the selector. The correct DNS entry should be under s1._domainkey.example.com. If your DNS provider or admin mistakenly points it to s1._domainkey.test.com, any verification system — including MailTester — will return a 404. The system can’t confirm your domain’s authenticity, so it treats the email address as unverifiable.

Impact on Verification and Deliverability

False negatives from missing or misconfigured DKIM records can break bulk email campaigns. You might discard valid addresses because the system flags the domain as unauthenticated. This hurts list hygiene and inflates your bounce rate.

Many email providers, including Gmail and Outlook, use DKIM as a core part of their spam filtering. A failed DKIM check reduces sender reputation and increases the risk of messages landing in spam folders. The problem isn’t the email address — it’s the domain’s inability to prove ownership via DNS.

Use a DNS lookup tool to verify your records. Check MXToolbox or Google’s public DNS service to confirm the TXT record exists at the correct location before launching campaigns. For a deeper check, test your setup with inbox placement tools before sending bulk mail.

With MailTester’s inbox placement tester, you can validate not just address validity, but how your message performs across real inbox environments — including whether DKIM authentication passes.

How to Verify DKIM Records Are Correct and Publishable

You can verify DKIM records are correct and publishable by testing both the DNS TXT record and the email address in real time using a tool like MailTester’s API. It checks the full DKIM validation path—including DNS lookup, signature structure, and key alignment—so you don’t miss missing, malformed, or unreachable records. If the record returns a 404, the tool flags the domain as lacking proper DKIM setup, helping you address the root cause before sending.

Test the Full DKIM Path, Not Just the Record

Simply checking for a TXT record with the correct selector isn’t enough. DKIM relies on a full chain: the domain must publish a valid TXT record at s=selector, and that record must contain a functional public key that matches the signature in the email. A 404 response means the DNS lookup failed—either the record doesn’t exist, is misspelled, or the DNS server isn’t resolving it.

Let’s say you’re verifying [email protected]. MailTester’s verification API doesn’t just ping the domain. It checks whether the DNS resolves dkim._domainkey.company.com (or s=selector if using a custom selector), pulls the full TXT value, parses the DNS structure, and validates that the key matches the cryptographic signature expected in the email header. This means you catch both configuration errors and delivery issues early.

Use the Right Tool to Catch Missing or Faulty DKIM

Many email verification tools only confirm if an address exists. Few validate the underlying cryptographic setup. MailTester’s real-time verification API goes further—it tells you not just if an email is real, but whether your DKIM setup is correctly published and functional for that domain. A 404 response isn’t just a DNS error. It’s a red flag that your domain may be blocked or rejected by receiving servers due to missing or unverifiable DKIM.

According to the IETF’s RFC 6376, proper DKIM implementation requires a resolvable public key record. When a domain fails to resolve this, receiving servers may reject or downgrade the message. Use MailTester to catch these issues before they harm sender reputation, especially during bulk sends or inbox placement tests.

Once you validate the record, publish it properly. Then test again. The feedback loop ensures your DKIM setup is both technically accurate and deliverability-ready.

Fixing the DKIM s= Selector DNS Issue Step by Step

If your DNS TXT record for DKIM with selector s= returns a 404, it usually means the record is missing, misconfigured, or not published. The correct DNS record should be at s1._domainkey.yourdomain.com and must start with v=DKIM1;. You need to verify the record exists in your DNS zone file, correct any typos in the selector or domain, and wait for propagation. Use tools like DNSChecker.org or dig to validate the fix after changes.

How to Correct the DKIM Selector Record

Log into your DNS management panel — Go to your domain registrar or hosting provider’s DNS dashboard (GoDaddy, Cloudflare, AWS Route 53, etc.). This is where your domain’s DNS records are stored.
Locate the record for s1._domainkey.yourdomain.com — Look for a TXT record with this subdomain. If it’s missing or named differently (like 1s._domainkey), that’s your issue.
Verify the record type and value — The record must be of type TXT. The value must start with v=DKIM1;, followed by the actual DKIM key. A missing or malformed header breaks verification.
Fix typos in the selector or domain — Common errors include reversing the selector (1s instead of s1), missing underscores, or typos in your domain name. Even a single character difference breaks the lookup.
Save changes and wait for DNS propagation — DNS changes can take 5 to 30 minutes to propagate globally. Avoid re-checking too soon; use DNSChecker.org to monitor real-time updates.
Recheck using a DNS lookup tool — Run dig TXT s1._domainkey.yourdomain.com or query via a public tool to confirm the record is now visible and correctly formatted.

Why This Matters for Email Verification and Deliverability

DKIM validation fails when the DNS record is unreachable or incorrect, leading to higher bounce rates and poor sender reputation. Email providers like Gmail and Outlook validate DKIM signatures before delivering messages. A missing or misconfigured s= selector triggers failures during verification and can flag your domain as untrusted.

For teams managing high-volume email sends, ensuring DNS records are correct prevents false negatives in email list hygiene. You can test your domain’s deliverability setup with a real-time inbox placement test: try MailTester’s inbox placement tester for a clear view of how your emails land in real inboxes.

DKIM Verification in MailTester: What the Results Mean

If MailTester reports a 404 error when checking the DKIM TXT record for a given selector, it means the domain’s email authentication is incomplete or broken. This triggers a 'risky' or 'invalid' status, indicating your emails may be flagged or blocked by receiving servers. Fixing this issue helps avoid deliverability problems before sending to your full list.

How MailTester Evaluates DKIM Records

You send an email address through MailTester, and we check the domain’s DNS for the DKIM record using the specified selector (s=). If the record is present and correctly formatted, we return a high-confidence 'valid' result. This means your domain is set up to sign outgoing messages, which improves trust with email providers.

If the lookup fails and returns a 404 error — meaning the DNS record doesn’t exist at that path — MailTester flags it as 'risky' or 'invalid'. This typically means the domain either never set up DKIM, removed the record, or configured it incorrectly. According to RFC 6376, DKIM signing must be matched by a public key in DNS to validate authenticity; no record equals no proof.

Why This Matters Before You Send

A missing or unreachable DKIM record doesn’t just hurt your reputation — it makes your emails vulnerable to filtering. Even if an address is syntactically correct, senders without proper DKIM are often treated as less trustworthy by systems like Gmail, Outlook, or enterprise filters.

Use this data to identify domains where authentication is missing. Prioritize fixing those before bulk sending. For example, if 8% of your list returns "risky" on DKIM, you can exclude or verify those domains first. You can check individual addresses via our email checker or process your full list with our bulk verification tool — both help surface these issues early.

Proper DKIM setup isn’t just about compliance. It’s part of a broader email deliverability strategy involving SPF, DMARC, and sender reputation. Check your full authentication chain using tools like MxToolbox or Spamhaus to validate the full picture.

What Happens If You Ignore the DKIM s= Selector 404 Error?

If you ignore a 404 error for your DKIM s= selector, your emails won’t pass authentication checks on Gmail, Outlook, and other major providers. This breaks sender alignment, reduces inbox placement, and makes your domain appear untrustworthy. Verification tools can’t confirm domain legitimacy when authentication fails, which means your list hygiene process is compromised. Even a single failed authentication step can tank deliverability.

What You’re Actually Risking

Mail sent from your domain will fail DKIM verification, especially with providers that enforce strict alignment policies (like Google and Microsoft). This often results in messages being marked as spam or rejected outright.
Without a valid TXT record at the expected DNS location, email receivers can't validate your domain’s authenticity, which hurts sender reputation over time — especially if you're sending at scale.
Verification tools like MailTester’s bulk verification won’t confirm your domain is legitimate, even if individual addresses are syntactically valid — you're left guessing whether your outbound emails will be trusted.
Weak or missing DKIM alignment increases chances of inbox placement drops, especially for campaigns targeting sensitive industries like finance or healthcare.
If you're using email verification to pre-validate a list before sending, a 404 error on the s= selector means your validation process is incomplete — you’re only checking syntax, not actual sender trustworthiness.

Why This Isn’t Just a Technical Quirk

Think of DKIM as a digital signature for your domain. If the public key isn’t where the receiver expects it (i.e., the DNS TXT record returns 404), the signature is invalid. This is standard practice: RFC 6376 defines the exact location of the DKIM public key record based on the selector and domain. Ignoring a missing record means your domain isn’t part of the email security ecosystem.

Even if your sender IP is clean and your list is well-maintained, a broken DKIM setup undermines everything. It’s like showing up to a meeting with a valid ID — but your ID was issued by a non-existent agency. The system can’t verify your authenticity, and trust breaks down.

Let’s be clear: you don’t need perfect delivery every time. But you do need your technical basics working. A 404 for your s= selector isn’t a minor glitch — it’s a red flag that breaks one of the core layers of email authentication.

Fix the DNS record, verify it with a real tool, and ensure your entire email flow respects the standards. If you’re not sure your setup is correct, run a test via MailTester’s inbox placement tester to check how your emails behave in real inboxes. That’s the only way to know if your authentication is actually working.

Fixing DKIM and Strengthening Email Verification in 2026

Missing or broken DKIM records lead to failed verifications and lower inbox placement. A DNS TXT record returning 404 for an s= selector means your domain’s DKIM configuration is incomplete or misconfigured.

Use MailTester’s bulk verification to scan your entire list and flag domains with invalid or missing DKIM records. These are high-risk entries that harm sender reputation and increase bounce rates.

Proactive validation for better deliverability

Run inbox-placement tests monthly to monitor deliverability trends and detect emerging issues before they affect campaigns.
Integrate the real-time API to validate every new signup immediately — prevent invalid or risky emails from entering your system.
Use the in-app AI assistant to interpret verification results and prioritize fixes based on risk level.

Verifying emails isn’t a one-time task. It’s a continuous process that protects your sender reputation and keeps your messages in inboxes, not spam folders.

Sources

52.1% of the world's top 1.8 million domains (937,931 domains) now publish a valid DMARC record, up from 29.1% in 2023. — EasyDMARC 2026 DMARC Adoption & Enforcement Report (2026)
Google reported 265 billion fewer unauthenticated messages sent to Gmail users in 2024 — a 65% reduction — after its bulk-sender rules took effect, with 500,000+ top domains publishing DMARC records in response. — Google (via MailOver bulk-sender requirements guide) (2024)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does a 404 error on a DKIM TXT record mean?

It means the DNS lookup for the selector-specific record returns no result. The domain likely lacks a published DKIM key for that selector.

Can a DKIM s= selector be wrong even if the email sends?

Yes. A misconfigured selector may allow delivery but fail authentication checks, leading to lower inbox placement and verification issues.

How long does it take for a corrected DKIM DNS record to work?

DNS propagation typically takes 5 to 30 minutes, but can be longer depending on TTL settings and the provider.

Does MailTester check DKIM records during email verification?

Yes. MailTester performs a full DKIM validation, including DNS lookup for the TXT record, before returning a verification verdict.

Can a role or disposable email pass DKIM verification?

Yes — if the domain has a valid DKIM record and the message is signed, the signature can pass verification even for temporary addresses.

Why does my domain pass DKIM but still get flagged as risky?

Other issues like low sender reputation, inactive IP, or misconfigured SPF may cause a risky verdict even if DKIM is valid.

Should I fix my DNS TXT record for DKIM before list verification?

Yes. A working DKIM record ensures accurate verification results and improves sender authentication for outbound emails.

How many DKIM records can a domain have?

A domain can have multiple DKIM selectors, but each must be published as a separate TXT record with its own subdomain.

Does changing the DKIM selector affect email delivery?

Yes. All outgoing emails must be re-signed with the new selector. Old messages may fail authentication until the new key is active.

Is it safe to remove old DKIM records?

Only after confirming no active emails rely on the old key. Keep old records until all messages have been delivered and the key is no longer required.

Can DNS caching cause a false 404 error?

Yes. Cached DNS responses may show 404 even after the record is published. Use tools with global lookups to confirm if it's an actual issue.

How accurate is MailTester at detecting missing DKIM records?

MailTester’s verification process includes DNS validation with 98.9% accuracy, detecting missing or malformed DKIM records effectively.