You got **DKIM is missing, failed, or weak**. Receiving servers cannot authenticate the message with DKIM, or the key is too weak.

Without DKIM (and alignment), DMARC cannot pass on the DKIM path.

## What to add

Open **Domains → the failing domain**. Copy the **DKIM** CNAME rows exactly. Lumail issues three CNAMEs:

| Type | Host | Value |
| --- | --- | --- |
| CNAME | `TOKEN._domainkey` | `TOKEN.dkim.amazonses.com` (region-specific host from the page) |

Do not invent tokens. Do not turn them into TXT records. Do not flatten the CNAME to an A/AAAA.

If the domain page shows **Legacy Easy DKIM**, keep those records; do not mix them with a second DKIM setup on the same name.

## Checklist

1. Each host is under `_domainkey` on **this** sending domain.
2. The value matches the domain page (copy, don’t retype).
3. Proxy/orange-cloud is **off** on Cloudflare — DNS only.
4. Wait for propagation, then verify on the domain page.

## After it passes

DKIM must stay published. Deleting a CNAME later reopens this alert and will fail DMARC alignment for Lumail mail.

## Related

- [How to verify a sending domain](/docs/deliverability/how-to-verify-sending-domain)
- [Email Domains](/docs/domains/email-domains)