What happens when a DKIM CNAME points at a name with no key?

RFC 6376 section 6.1.2 says that if the query for the public key fails because the key record does not exist, the verifier MUST immediately return PERMFAIL. It is a permanent failure, not a retry.

Why do DKIM checkers say the record is fine?

Because a CNAME record does exist at the selector name. A checker that only asks whether a record is present stops there. The failure is one hop further on, at the name the CNAME points to.

How do I check a DKIM CNAME target?

Run dig +short CNAME on the selector to see the target, then dig +short TXT on the selector to follow it. The TXT query should return a string containing p=. Query TXT, not A: an address at the target does not mean a key is published there.

How do I fix a dangling DKIM CNAME?

Compare the target against the vendor's domain authentication page character by character and correct it. If the vendor is no longer in use, delete the selector record so nothing signs with it.

Your DKIM selector points to a CNAME with no key behind it

The selector record exists, so any checker that only asks "is there a record" says fine. But the record is a CNAME, and the name it points to returns no TXT.

Nothing signed with that selector can be verified, and RFC 6376 does not let the verifier treat that as a maybe.

What the record looks like

$ dig +short CNAME s1._domainkey.example.com
s1.domainkey.example-vendor.net.

and then

$ dig +short TXT s1.domainkey.example-vendor.net
(no answer)

The selector delegates, and the name it delegates to publishes no key.

What the standard says

RFC 6376, section 6.1.2, Get the Public Key:

3. If the query for the public key fails because the corresponding key record does not exist, the Verifier MUST immediately return PERMFAIL (no key for signature).
[...]

Permanent failure, not a retry. Every message carrying that selector in its DKIM-Signature header is unverifiable for as long as the target is empty.

Why it happens

The vendor rotated or removed the key on their side and your CNAME still points at the old name. The CNAME target was typed with a mistake and never tested. Or you left the vendor, their record went away, and your CNAME stayed.

Check it yourself

dig +short CNAME s1._domainkey.example.com
dig +short TXT   s1._domainkey.example.com

The first prints the target. The second follows the CNAME and should print a string containing p=. If the first prints a target and the second prints nothing, this is the finding.

Query TXT, not A. A CNAME target that resolves as an address tells you the name exists; it does not tell you a key is published there.

The fix

Open the vendor's domain authentication page and compare the CNAME target character by character. If the vendor is gone, delete the selector record so nothing signs with it.

If you do not know which sender uses the selector, read the s= tag in the DKIM-Signature header of mail from each tool you use until you find it.

If you need to build the record from scratch, Sidemail's DKIM generator does it in a minute.

Run your domain audit at audit.humerly.com. No signup, no card.