Guide BillionMail DKIM Fails Even Though the DNS Record Exists: How to Fix

Guide BillionMail DKIM Fails Even Though the DNS Record Exists: How to Fix - Printable Version

+- AdminsForum (https://adminsforum.com)
+-- Forum: Free & open-source control panels (https://adminsforum.com/Forum-free-open-source-control-panels)
+--- Forum: aaPanel (https://adminsforum.com/Forum-aapanel)
+---- Forum: aaPanel Guides & Tutorials (https://adminsforum.com/Forum-aapanel-guides-tutorials)
+----- Forum: aaPanel BillionMail Guides (https://adminsforum.com/Forum-aapanel-billionmail-guides)
+----- Thread: Guide BillionMail DKIM Fails Even Though the DNS Record Exists: How to Fix (/Thread-guide-billionmail-dkim-fails-even-though-the-dns-record-exists-how-to-fix)

BillionMail DKIM Fails Even Though the DNS Record Exists: How to Fix - JAY - 10-23-2026

BillionMail DKIM fails even though the DNS record exists: how to fix

DKIM is the digital signature on your emails. If it fails, Gmail and Outlook trust your mail less, and DMARC can fail too. The frustrating part: often the DKIM record is in your DNS, and it still fails. We hit exactly this on our test server. Here's how to find the real cause.

How DKIM works, in one paragraph
BillionMail signs every email with a private key. The signature header names a selector (

Code:

s=

) and a domain (

Code:

d=

). The receiving server then looks up the public key at

Code:

SELECTOR._domainkey.DOMAIN

in DNS and checks the signature. If the record is at a different name, contains a different key, or is broken, DKIM fails.

Step 1: Find the selector your mail really uses
Don't guess. Send a test email to a Gmail address, open it, click the three dots and choose Show original. Find the

Code:

DKIM-Signature

header:

Code:

DKIM-Signature: v=1; a=rsa-sha256; d=news.example.com; s=default; ...

Note the

Code:

s=

value (the selector) and the

Code:

d=

value (the domain). In the same view, Gmail shows

Code:

DKIM: 'PASS'

Code:

'FAIL'

near the top.

Our case: BillionMail's DNS page showed the record for

Code:

default._domainkey

, but our mail was signed with the selector

Code:

short

. Adding a record for

Code:

short._domainkey

with the same key fixed it instantly.

Step 2: Check the record at exactly that name

Code:

dig +short TXT default._domainkey.news.example.com

Replace

Code:

default

and the domain with your

Code:

s=

and

Code:

d=

values. You should get one long text starting with

Code:

v=DKIM1; k=rsa; p=...

.

Step 3: The usual causes
1. Wrong host name. Many DNS providers add your domain automatically. If you enter

Code:

default._domainkey.example.com

, the record ends up at

Code:

default._domainkey.example.com.example.com

. Enter just

Code:

default._domainkey

(plus the subdomain part if you send from one, e.g.

Code:

default._domainkey.news

).

2. Key cut off. The BillionMail DNS window shortens the key with "..." on screen. Always use the Copy button, never copy the visible text:
[Image: attachment.php?aid=415]

Then compare: the

Code:

p=

value from

Code:

dig

must be the full key, with no spaces or line breaks in the middle.

3. Key too long for your DNS provider. A 2048-bit key is longer than 255 characters. Good DNS providers split it into parts automatically; some old panels cut it off or reject it. If yours does, select 1024-bit RSA Key as the DKIM Record Format in the same window and use that record instead. 2048-bit is stronger, but 1024-bit that works beats 2048-bit that doesn't.

4. Wrong domain. The

Code:

d=

domain is the domain you added in BillionMail. If you send from

Code:

news.example.com

, the record belongs under

Code:

news.example.com

, not the main domain.

5. Two different keys. If you reinstalled BillionMail or re-added the domain, it may have generated a new key. The old record in DNS no longer matches. Copy the current one again.

6. DNS not updated yet. Changes can take up to an hour (longer if the old record had a long TTL). Check with

Code:

dig

before testing again.

Step 4: Confirm the fix

Code:
dig
shows the full key at the right name.
In BillionMail, Domain > DNS Records shows DKIM green.
A fresh test in Gmail's Show original shows
Code:
DKIM: 'PASS'
with your domain.
A free email tester shows DKIM and DMARC passing (see our deliverability guide).

DKIM passes but DMARC fails?
DMARC needs SPF or DKIM to pass and use the same domain as the From address. Send from an address on the domain you set up in BillionMail. More in BillionMail DNS setup: MX, SPF, DKIM, DMARC and PTR.

Sources: RFC 6376: DKIM · Google: set up DKIM

More BillionMail troubleshooting

Applies to BillionMail 4.9 installed through aaPanel or the install script, October 2026.