Documentation menu

DKIM Verification Troubleshooting

This guide helps you diagnose and fix DKIM/SPF verification issues in PostBeagle.

How PostBeagle Authentication Works

PostBeagle sends and signs your mail on its own infrastructure (a self-hosted Postfix/Rspamd stack). Authentication relies on records published directly on your domain — there is no proxy or "white-label" DNS layer.

DKIM (DomainKeys Identified Mail)

PostBeagle generates a key pair for your domain. You publish the public key as a single TXT record; PostBeagle holds the private key and signs your mail with it.

Name:  s1._domainkey.yourdomain.com
Type:  TXT
Value: v=DKIM1; k=rsa; p=<your public key>

PostBeagle verifies DKIM by resolving s1._domainkey.yourdomain.com and confirming the TXT record contains your domain's public key.

SPF (Sender Policy Framework)

SPF authorizes PostBeagle's servers to send for your domain via an include:

v=spf1 include:spf.postbeagle.com ~all

PostBeagle verifies SPF by resolving your domain's TXT records and confirming one contains include:spf.postbeagle.com.

A domain is marked verified only when both DKIM and SPF pass.

Common Issues

Issue 1: DNS Records Not Found

Symptoms:

  • Verification shows "DNS records not found"
  • Status shows ⏳ Pending for more than 24 hours

Causes:

  1. Records not added yet
  2. DNS propagation delay
  3. Wrong record type or name
  4. DNS provider issues

Solutions:

Step 1: Verify the records were added

Log in to your DNS provider and check:

  • The DKIM record exists at s1._domainkey.yourdomain.com
  • Its type is TXT (not CNAME, not A)
  • The SPF TXT record on your root domain contains include:spf.postbeagle.com
  • Values match the PostBeagle instructions exactly

Step 2: Check DNS propagation

# DKIM
dig s1._domainkey.yourdomain.com TXT

# SPF
dig yourdomain.com TXT

Expected DKIM output (abbreviated):

s1._domainkey.yourdomain.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."

If no results: DNS hasn't propagated yet — wait and try again.

Step 3: Check the record name and type

Common mistakes:

❌ Wrong: s1._domainkey (missing domain) ✅ Correct: s1._domainkey.yourdomain.com

❌ Wrong: s1.domainkey.yourdomain.com (missing underscore) ✅ Correct: s1._domainkey.yourdomain.com

❌ Wrong: Type CNAME ✅ Correct: Type TXT

Step 4: Wait for propagation

DNS propagation is typically 1-2 hours and at most 24-48 hours. Lower TTLs (3600 or Auto) propagate faster. You can also clear your local DNS cache or query from another network.

Issue 2: DKIM Value Wrong or Truncated

Symptoms:

  • The record is found but verification fails
  • The public key looks shorter than what PostBeagle shows

Causes:

  1. The long public key was truncated when pasting
  2. A character was changed or a space/quote was added
  3. The DNS provider split or reformatted the value

Solutions:

  1. Use the copy button in PostBeagle — don't type the key manually
  2. Compare the full value, including the entire p=... portion
  3. Check provider formatting — some providers wrap long TXT values in quotes or split them into chunks; that's usually fine, but make sure no characters were lost
  4. Delete and re-create the record, then re-verify after propagation

To inspect the full value:

dig s1._domainkey.yourdomain.com TXT +short

Issue 3: SPF Not Detected

Symptoms:

  • DKIM passes but verification still fails
  • "SPF record does not contain include:spf.postbeagle.com"

Causes:

  1. The SPF record is missing
  2. You have two SPF records (only one is allowed — they must be merged)
  3. The include is misspelled

Solutions:

  1. Confirm a single SPF TXT record exists on your root domain
  2. Ensure it contains include:spf.postbeagle.com
  3. If you already had an SPF record, merge rather than add a second one: 
    v=spf1 include:_spf.google.com include:spf.postbeagle.com ~all
dig yourdomain.com TXT | grep spf1

Should return exactly one v=spf1 record.

Issue 4: Duplicate / Conflicting Records

Symptoms:

  • Verification is inconsistent
  • Multiple records with the same name

Cause: More than one record at s1._domainkey.yourdomain.com, or multiple SPF records, causes conflicts.

Solution:

  1. Check for duplicates in your DNS provider
  2. Remove the extras so there is exactly one DKIM record and one SPF record
  3. Wait for the deletion to propagate, then re-verify
dig s1._domainkey.yourdomain.com TXT +short

Should return a single value.

Issue 5: DNS Provider Limitations

Symptoms:

  • Can't add the record at the required name
  • Subdomain restrictions

Solutions:

Option 1: Use a subdomain

Add mail.yourdomain.com as its own domain in PostBeagle and publish the records there.

Option 2: Use a more flexible DNS provider

Cloudflare (free), DNSimple, Namecheap, and others all support the records PostBeagle needs.

Option 3: Contact your provider

Ask them to add the TXT records for email authentication if their UI is restrictive.

Advanced Troubleshooting

Check DNS from Multiple Locations

# Google DNS
dig @8.8.8.8 s1._domainkey.yourdomain.com TXT

# Cloudflare DNS
dig @1.1.1.1 s1._domainkey.yourdomain.com TXT

# Your resolver
dig s1._domainkey.yourdomain.com TXT

Clear Your DNS Cache

Windows:

ipconfig /flushdns

Mac:

sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

Linux:

sudo systemd-resolve --flush-caches

Test Email Authentication

Send a test email and check the headers:

  1. Send an email to yourself
  2. View the message source/headers
  3. Look for the DKIM signature: 
    DKIM-Signature: v=1; a=rsa-sha256; d=yourdomain.com; s=s1;
  4. Check the authentication results: 
    Authentication-Results: dkim=pass; spf=pass

Use Online Tools

DNS / DKIM checkers:

Email testers:

A Note on DKIM Keys

Your DKIM key doesn't expire and there's no periodic "refresh" to perform — once your records are verified, leave them in place. Because the public key lives directly in your TXT record, the only time you'd change it is the rare case where a key has to be re-issued, and PostBeagle will tell you if that's ever needed.

Getting Help

Before Contacting Support

Gather this information:

  1. Domain name
  2. DNS provider name
  3. Screenshots of the DNS records
  4. The error message from PostBeagle
  5. Output from the dig commands above

Contact Support

Email: [email protected]

Include:

  • Subject: "DKIM Verification Issue - [yourdomain.com]"
  • All the information above
  • What you've already tried

Response time: Usually within 24 hours

FAQ

How many DKIM records do I need?

One — a single TXT record at s1._domainkey.yourdomain.com.

Can I use a different DNS provider than my registrar?

Yes. Use any DNS provider; just point your registrar's nameservers at it.

What if I can't add the record at that name?

Use a subdomain or switch to a more flexible DNS provider.

Do I need to update DNS when keys "rotate"?

There's no automatic key rotation. Your records stay the same once verified.

Can I verify before DNS propagates?

No. DNS must propagate first — wait 1-24 hours after adding the records.

Why does verification work sometimes but not others?

Usually DNS propagation in progress, or duplicate/conflicting records.

Additional Resources