Sign mail from a domain verifiedcriticalWritten by the Hub
Key, pattern, Store key, DNS — in that order, with two traps: the generated key is too short and a key without a pattern signs nothing.
In detail
The order matters more than it looks. Patterns created inside the form are not saved until the key itself is stored, so a key saved first and patterned afterwards is a key that signs nothing — and the list shows it as complete. Nothing in the interface warns about it. The checkbox offering to use the key only if it matches DNS does nothing at all: the value is overwritten on save, and the enforce column records whether an algorithm was chosen instead. Auto-detect makes the engine fetch the published key at start-up and log an NXDOMAIN when it is missing, which is the closest thing to a warning available.