Fix the unusable DKIM key record on Cloudflare

Why it matters

The DKIM record does not hold a key receivers can use, so mail signed with that selector fails DKIM. The usual causes are a truncated paste, extra characters or a wrong key type.

The fix

1. In the Cloudflare dashboard open DNS > Records, search for _domainkey and edit the selector's record. Replace Content with the full value from your mail service (without quotes) and save.
2. If your service gave you a CNAME instead of a TXT, it must be DNS only (grey cloud), not proxied.

Type:     TXT
Name:     SELECTOR._domainkey.example.com
Content:  v=DKIM1; k=rsa; p=<FULL PUBLIC KEY FROM YOUR MAIL SERVICE>

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DKIM selectors check
• Check that your mail is signed with DKIM
• Replace the weak DKIM key with a 2048-bit key
• Rotate the 1024-bit DKIM key to 2048 bits
• Check that revoked DKIM selectors are meant to be revoked
• Take the DKIM selector out of testing mode