DKIM signature missing" on agent-sent emails - the sending service wasn't configured for the domain
Restores missing DKIM signatures on agent-sent recruiting email. Use it when mail headers show no DKIM-Signature or checkers report dkim=none. Key trigger: the sending service was never given DNS records for the domain.
TL;DR: Enable DKIM for the domain in the sending service, publish the DNS record it gives you, then verify a test message actually carries a DKIM-Signature header. A DNS record alone does nothing if the sender never signs. Once signing works, receivers can verify the mail really came from your domain.
DKIM signature missing- In the sending service's domain settings, enable DKIM; it will show a selector name and the DNS record to publish. Expected: the dashboard shows DKIM as pending with record details.
- Publish the record in the domain's DNS (at [selector].domainkey.[your domain], or the CNAME the service asks for). Expected: `dig TXT [selector].domainkey.[your domain]` returns the published value.
- Send a test message and view the raw headers. Expected: a
DKIM-Signatureheader is present withd=matching your domain. - Check the Authentication-Results header or an external mail tester. Expected:
dkim=passfor your domain.
Use this when
- Headers show
dkim=noneor no DKIM-Signature header at all. - A new sending domain or ESP was set up and mail auth was skipped.
- Deliverability dropped and SPF alone is passing.
Not for this skill when
- A DKIM signature exists but fails verification (key mismatch or rotation issue).
- DMARC fails on alignment while DKIM passes under the ESP's own domain.
- The problem is SPF or DMARC policy, not signing.
Variant phrasings
- "dkim=none in Authentication-Results"
- "no DKIM signature on outbound mail"
- "DKIM not configured for domain"
- "enable DKIM on sending domain"
Why it happens
Most sending services do not sign with your domain until you complete their DKIM setup, and recruiting agents are often wired up by copying credentials and skipping the DNS steps. Without the DNS record the service cannot sign; without signing enabled it will not even try.
Edge cases
- Some providers use CNAME records for DKIM, not TXT; follow the provider's exact record type.
- Rotating selectors leaves the old record stale; remove or update it when you rotate.
- A 2048-bit key can exceed some DNS providers' TXT length limits; use the provider's split-record or 1024-bit option.
- Signing with the ESP's default domain passes DKIM but fails DMARC alignment under a strict policy.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_Y6-NtJU8rpDc0P0sCJgLIw