Question DKIM Selector "not found" issue.... why?

[Kwasi]

Server operating system version

windows Server 2019

Plesk version and microupdate number

18.0.61

I'm having DKIM issues.
I see a "dkim=perm_fail" in email headers on an email sent to a yahoo account.
Gmail will not allow any emails to arrive saying it needs SPF and DKIM to be successful.

SPF is a-aok and yahoo email acknowledges that.

I create a selector in Plesk (Windows Obsidian 18.0.61 version btw)
Add the required records over at Sucuri in the DNS from the popup within Plesk
but DKIM fails.

using the default MailEnable setup within Plesk

if I use some of the DKIM validator websites, when I enter the "selector" I get "No DKIM records found" but they are there... I'm looking at them now in my Sucuri Dashboard.

Made a support request at Sucuri regarding it but they need to escalate it to a higher up engineer so I'm waiting on that.

So....
Any thoughts on what might be wrong?

 

[Kwasi]

OK, so I went to whatsmydns . net and looked for all txt records, and the DKIM one did NOT show up at all, so that's probably my real issue...but then why not?

According to my Plesk Email settings and the popup that appears if using external DNS:

==========
To enable DKIM signing if you use an external DNS server, you need to configure DKIM DNS records on the DNS server yourself.

To do so, use the DKIM DNS records below:

• RSSS1._domainkey.rsss.ch. IN TXT "v=DKIM1; p=MIIBIjAN etc.... ;"
• _domainkey.rsss.ch. IN TXT "o=-

A few people I chatted with suggested that 2nd _domainkey..... entry isn't really needed.

So if I'm following the Plesk docs correctly, why no DKIM TXT record showing?

 

[Kaspar@Plesk]

OK, so I went to whatsmydns . net and looked for all txt records, and the DKIM one did NOT show up at all, so that's probably my real issue...but then why not?

If I understand correctly your using an external DNS provider, right? Did you add the DKIM record there? If you did, but it doesn't show up, it a question best directed at them.

A few people I chatted with suggested that 2nd _domainkey..... entry isn't really needed.

That would depend on the DKIM key length supported by the the DNS application OR DNS provider. Some have a limit on the number of charters that can be used on the DNS value, necessitating a split of the DKIM key into two DNS records. However most up-to-date DNS applications and providers support the full DKIM key length.