Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working on getting DKIM installed on my outgoing mail server, to help my email deliverability to my Yahoo clients (all legit emails, etc, no spamming).

I've got DKIM-Signature: and DomainKey-Signature: headers being generated, but a test mailer to my Yahoo account had this line in the headers:

Authentication-Results:; domainkeys=permerror (no key);; dkim=permerror (no key)

Any ideas what I may have missed?

share|improve this question
Did you set the proper dns records? What is your domain name? – cstamas Jun 3 '09 at 7:22
up vote 3 down vote accepted

You do not have the proper dns records set up.

You can test it youself with policy checker and selector checker. Here is a good tutorial for setting the right records. and also and online form for doing the same. It seems that you have SPF records. You should definitely remove them! Here is a case against spf.

share|improve this answer
my primary use for spf is delivering email to is there an alternative? does gmail support dkim? – Ian Jun 3 '09 at 20:44
yes gmail supports dkim – cstamas Jun 4 '09 at 8:05
Yes something like that. – cstamas Jun 4 '09 at 22:41
Certain big ESPs (like Hotmail) still use SPF and not DKIM, so I wouldn't suggest removing it. – user5401 Jun 9 '09 at 14:12
@cstamas: that article you refer to is severely outdated, written when there was still some debate about whether or not to use SPF. None of the reasons given by Mr. Pollard have stood the test of time, and SPF is a perfectly valid tool advocated by the majority of major email systems. – Mixologic Dec 19 '12 at 16:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.