DKIM Keys verifiedcriticalWritten by the Hub

The order that works: create the key with a domain and a selector, generate or paste the private key, add patterns inside the form, then press Store key — patterns added before that press live only in the form. The screen then offers the public half in four shapes: the bare key, a DNS record, bind9 and TinyDNS. Key settings: signature type (DKIM, ARC or both — both is the default), algorithm (auto-detect, SHA1 or SHA256, the last being default), canonicalisation (four combinations, relaxed/simple by default), extra headers to sign, a signature expiry, a priority, failure reports and oversign. The three defects above were each verified rather than inferred. The most consequential is the first: enforce does not mean "check against DNS", it means "the algorithm was stated, so no DNS lookup is needed" — with auto-detect the engine fetches the published key at start-up and logs an NXDOMAIN if it is not there.