# DKIM: dkim=permerror (no key for signature) / key not found in DNS selector._domainkey

**Code:** `DKIM: no key for signature` · **Category:** Email / SMTP · **Seen on:** SMTP, Linux

The message is signed with a selector, but the receiver found no DKIM public key in DNS at that selector, so verification cannot proceed.

## Meaning

DKIM keys live in TXT records at `<selector>._domainkey.<domain>`. If the record is missing, wrong selector, not yet propagated, split badly (long 2048-bit keys need correct quoting) or at the wrong domain, signature checking fails. Compare `s=` and `d=` in the DKIM-Signature header with your DNS.

## Common causes

- Selector in DKIM-Signature differs from the published record
- Record not yet propagated
- Public key truncated or split incorrectly
- Published under the wrong domain/subdomain
- Provider rotated keys and old records were deleted

## Quick fix

1. Read `s=` and `d=` from the signature, query `selector._domainkey.domain`
2. Re-publish the exact key from your provider
3. Wait for TTL and recheck

## Detailed fix by platform

### Linux

1. `dig +short TXT selector1._domainkey.example.com` should return `v=DKIM1; k=rsa; p=...`

## How to diagnose

1. **Selector** — s= value in header?
2. **DNS** — Record exists at that name?
3. **Key** — Complete public key?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/email/dkim-no-key-for-signature)