Start with the DKIM-Signature header on an actual sent message. Read d= for the signing domain and s= for the selector; the public key is looked up at <selector>._domainkey.<signing-domain>. Do not substitute the visible From address's domain unless it matches d=. RFC 6376, section 3.6.2.1 defines that DNS name.
The most common cause is a typo in the DNS record. The selector used by PulsePigeon is documented in the domain-onboarding flow; copy it verbatim. An extra dot inside the constructed owner name, a missing underscore, or a CNAME pointing to the wrong target can all cause this failure. A trailing dot marks an absolute DNS name in zone-file syntax and is not itself an error.
Verify with dig: dig TXT selector._domainkey.example.com should resolve the public key, directly or through a CNAME. Keep the full response when troubleshooting. NXDOMAIN means the queried name does not exist; NOERROR with no TXT answer, SERVFAIL, and a timeout have different causes. Missing output from a short-form query cannot distinguish them.
If you use a CNAME to delegate DKIM to a provider, verify the CNAME resolves. Some DNS providers cache negative answers for hours and won't retry quickly after you publish the record - this can manifest as 'selector not found' for the first few hours after onboarding.
Example diagnostic: a message signed with d=example.com; s=mail2026 queries mail2026._domainkey.example.com. If that name returns NXDOMAIN, compare the assigned DNS owner and target with what was published, including whether the DNS control panel appended the zone name twice. The example selector is fictional; use the selector from your message or onboarding records.
After correcting the DNS record, compare authoritative and recursive answers, allow cached negative answers to expire, and send a fresh test message. Inspect the recipient's Authentication-Results for DKIM verification. Resolving a key does not prove that the signature, body hash, or DMARC alignment passes.
The DNS checker can inspect a selector you supply; guessing a selector from the domain alone is not reliable. See the domain API reference for the provider-assigned DNS records.
To compare the published record with the identities in a real received message, follow the authentication and alignment checklist.
PulsePigeon's delegated DKIM model uses generation-specific selectors and CNAME targets in its managed authentication zone. Rotation creates a new selector generation; the domain status and DNS check surfaces show which records must resolve before the new generation is used.