Why DKIM and DMARC may not appear at the apex

Email authentication records typically use specific names under the domain.

Use the DMARC name

DMARC is commonly published as TXT at _dmarc.example.com. A TXT lookup for example.com may only show SPF or other verification text. The tool does not automatically enumerate all authentication subdomains.

DKIM needs a selector

DKIM commonly uses selector._domainkey.example.com. The selector comes from the sending system’s configuration, so obtain it from the provider or a message signature rather than guessing. A provider may also use CNAME to point to a managed key.

Account for key rotation

Old and new selectors may coexist while a mail system changes or rotates keys. Check the provider’s transition plan before deleting an old record, so messages still in transit are not deprived of the information needed to verify them.

This guide explains public DNS responses. Before changing production settings, check the documentation for your current domain and hosting providers.