While setting up DKIM signing with OpenDKIM you run the key test and get:
opendkim-testkey: 'default._domainkey.example.com' unexpected reply class/type (-1/-1)The DKIM key itself is usually fine. The error means OpenDKIM’s own DNS lookup failed – it couldn’t get any answer, so it can’t compare the published key with your private key.
Step 1 – Give OpenDKIM working resolvers
sudo nano /etc/opendkim.confAdd (or edit) the Nameservers line:
Nameservers 1.1.1.1,1.0.0.1Separate addresses with commas and no spaces. You can list more, e.g. 1.1.1.1,1.0.0.1,8.8.8.8,8.8.4.4.
Step 2 – Restart OpenDKIM
sudo systemctl restart opendkimStep 3 – Test the key
sudo opendkim-testkey -d example.com -s default -vvvReplace example.com and the selector (default) with yours. Success looks like:
opendkim-testkey: key OK“key not secure” just means the zone isn’t DNSSEC-signed – it’s normal and not an error.
Still failing? Check these
- Is the record published?
dig +short TXT default._domainkey.example.comshould return yourv=DKIM1; k=rsa; p=…record. - DNS propagation – new records can take time to appear, depending on TTL and provider (some providers publish within a minute).
- Firewall – the server must be able to query outside DNS on UDP and TCP port 53.
- Logs –
sudo journalctl -u opendkim --since "10 min ago"
Check it from outside
The SPF, DKIM & DMARC Checker looks up your DKIM selector from the public internet, along with SPF and DMARC.
Écrit par
Inder Kochar
Ingénieur systèmes et réseaux – Je rédige les solutions que j’applique chez mes clients, testées sur de vrais systèmes. Bloqué sur un problème similaire ?
