“no key for signature” — the DKIM key is missing from DNS

Where the key must live

The DKIM-Signature names two things: the domain in the d= tag and the selector in the s= tag. Every receiver builds the same name from those:

If that TXT record is missing, or carries no usable p=, you get exactly this message.

The most common causes

1. The record was never published. Signing enabled on the mail server, DNS entry forgotten — by far the most frequent case.
2. _domainkey duplicated. Many DNS interfaces append the domain name automatically. Enter the full name and you end up at selector1._domainkey.yourdomain.com.yourdomain.com. Looking at the name actually resolved exposes this instantly.
3. Selector mix-up. The server signs with s=mail while DNS carries default. What counts is always what the signature says.
4. Key rotation without overlap. The old selector was deleted while messages with the old signature were still in flight. When rotating, keep both selectors published in parallel for a while.
5. A CNAME pointing nowhere. With vendors the selector is usually a CNAME into their infrastructure. Cancel the service or move the account and the CNAME stops resolving.
6. The record was truncated on entry. A 2048-bit key exceeds 255 characters and must be split into several strings by the DNS provider. Some interfaces silently cut it instead.

Checking

Take the domain and selector from the d= and s= tags of the failed message and resolve the name directly:

Nothing returned settles it. If something comes back that does not start with v=DKIM1, or carries no p= with a long base64 value, the record is damaged.