DKIM not published

Symptom

The portal's Setup page shows the domain as Not published yet, or a received message shows dkim=none (or dkim=fail) for your domain even though the signature is present and X-RubySig-Stamped: yes is in the headers.

Mail still delivers — your platform's own SPF alignment carries it — but it is not carrying RubySig's signature, and a strict DMARC policy at the recipient may quarantine it.

Checks, in order

1. Is the record there at all?

   dig +short TXT rubysig1._domainkey.example.com
   

   Nothing back means the record has not been created, was created under the wrong name, or has not propagated yet. Wait ten minutes and try again before changing anything.

2. Is the name right? The host is rubysig1._domainkey under your domain. Common mistakes: entering the full rubysig1._domainkey.example.com at a provider that then appends the domain again (giving …example.com.example.com), or leaving out the underscore.

3. Is the value intact? Compare the length of what dig returns with the value on the Setup page. A value that ends early was truncated by the provider's input box; re-enter it, or split it into two quoted strings of under 255 characters each, which every provider accepts.

4. Is it the right domain? RubySig signs for the domain in the sender's address. If users send from mail.example.com and the record is under example.com, the selector does not exist for the signing domain. The Setup page lists every domain RubySig has seen for your organization and the status of each.

After fixing

The portal re-checks on a timer and turns the domain Published within a few minutes of the record resolving. The next message sent after that is signed; nothing needs restarting.