BillionMail DKIM fails even though the DNS record exists: how to fix
DKIM is the digital signature on your emails. If it fails, Gmail and Outlook trust your mail less, and DMARC can fail too. The frustrating part: often the DKIM record is in your DNS, and it still fails. We hit exactly this on our test server. Here's how to find the real cause.
How DKIM works, in one paragraph
BillionMail signs every email with a private key. The signature header names a selector () and a domain (). The receiving server then looks up the public key at in DNS and checks the signature. If the record is at a different name, contains a different key, or is broken, DKIM fails.
Step 1: Find the selector your mail really uses
Don't guess. Send a test email to a Gmail address, open it, click the three dots and choose Show original. Find the header:
Note the value (the selector) and the value (the domain). In the same view, Gmail shows or near the top.
Our case: BillionMail's DNS page showed the record for, but our mail was signed with the selector . Adding a record for with the same key fixed it instantly.
Step 2: Check the record at exactly that name
Replace and the domain with your and values. You should get one long text starting with .
Step 3: The usual causes
1. Wrong host name. Many DNS providers add your domain automatically. If you enter, the record ends up at . Enter just (plus the subdomain part if you send from one, e.g. ).
2. Key cut off. The BillionMail DNS window shortens the key with "..." on screen. Always use the Copy button, never copy the visible text:
![[Image: attachment.php?aid=415]](https://adminsforum.com/attachment.php?aid=415)
Then compare: the value from must be the full key, with no spaces or line breaks in the middle.
3. Key too long for your DNS provider. A 2048-bit key is longer than 255 characters. Good DNS providers split it into parts automatically; some old panels cut it off or reject it. If yours does, select 1024-bit RSA Key as the DKIM Record Format in the same window and use that record instead. 2048-bit is stronger, but 1024-bit that works beats 2048-bit that doesn't.
4. Wrong domain. The domain is the domain you added in BillionMail. If you send from , the record belongs under , not the main domain.
5. Two different keys. If you reinstalled BillionMail or re-added the domain, it may have generated a new key. The old record in DNS no longer matches. Copy the current one again.
6. DNS not updated yet. Changes can take up to an hour (longer if the old record had a long TTL). Check with before testing again.
Step 4: Confirm the fix
DKIM passes but DMARC fails?
DMARC needs SPF or DKIM to pass and use the same domain as the From address. Send from an address on the domain you set up in BillionMail. More in BillionMail DNS setup: MX, SPF, DKIM, DMARC and PTR.
Sources: RFC 6376: DKIM · Google: set up DKIM
More BillionMail troubleshooting
Applies to BillionMail 4.9 installed through aaPanel or the install script, October 2026.
DKIM is the digital signature on your emails. If it fails, Gmail and Outlook trust your mail less, and DMARC can fail too. The frustrating part: often the DKIM record is in your DNS, and it still fails. We hit exactly this on our test server. Here's how to find the real cause.
How DKIM works, in one paragraph
BillionMail signs every email with a private key. The signature header names a selector (
Code:
s=Code:
d=Code:
SELECTOR._domainkey.DOMAINStep 1: Find the selector your mail really uses
Don't guess. Send a test email to a Gmail address, open it, click the three dots and choose Show original. Find the
Code:
DKIM-SignatureCode:
DKIM-Signature: v=1; a=rsa-sha256; d=news.example.com; s=default; ...Code:
s=Code:
d=Code:
DKIM: 'PASS'Code:
'FAIL'Our case: BillionMail's DNS page showed the record for
Code:
default._domainkeyCode:
shortCode:
short._domainkeyStep 2: Check the record at exactly that name
Code:
dig +short TXT default._domainkey.news.example.comCode:
defaultCode:
s=Code:
d=Code:
v=DKIM1; k=rsa; p=...Step 3: The usual causes
1. Wrong host name. Many DNS providers add your domain automatically. If you enter
Code:
default._domainkey.example.comCode:
default._domainkey.example.com.example.comCode:
default._domainkeyCode:
default._domainkey.news2. Key cut off. The BillionMail DNS window shortens the key with "..." on screen. Always use the Copy button, never copy the visible text:
Then compare: the
Code:
p=Code:
dig3. Key too long for your DNS provider. A 2048-bit key is longer than 255 characters. Good DNS providers split it into parts automatically; some old panels cut it off or reject it. If yours does, select 1024-bit RSA Key as the DKIM Record Format in the same window and use that record instead. 2048-bit is stronger, but 1024-bit that works beats 2048-bit that doesn't.
4. Wrong domain. The
Code:
d=Code:
news.example.comCode:
news.example.com5. Two different keys. If you reinstalled BillionMail or re-added the domain, it may have generated a new key. The old record in DNS no longer matches. Copy the current one again.
6. DNS not updated yet. Changes can take up to an hour (longer if the old record had a long TTL). Check with
Code:
digStep 4: Confirm the fix
- shows the full key at the right name.Code:
dig
- In BillionMail, Domain > DNS Records shows DKIM green.
- A fresh test in Gmail's Show original shows with your domain.Code:
DKIM: 'PASS'
- A free email tester shows DKIM and DMARC passing (see our deliverability guide).
DKIM passes but DMARC fails?
DMARC needs SPF or DKIM to pass and use the same domain as the From address. Send from an address on the domain you set up in BillionMail. More in BillionMail DNS setup: MX, SPF, DKIM, DMARC and PTR.
Sources: RFC 6376: DKIM · Google: set up DKIM
More BillionMail troubleshooting
- Port 25 blocked: emails not sending
- SSL certificate won't apply
- Emails stuck in the send queue
- Can't open the dashboard
- Webmail (Roundcube) problems
- Emails going to spam
- Update safely and roll back
Applies to BillionMail 4.9 installed through aaPanel or the install script, October 2026.