Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Most DKIM failures in Webmin or Virtualmin come from one of four causes: OpenDKIM is missing or not configured, signing uses a different selector than the DNS record, the public key was copied incorrectly, or the record was added to a DNS server that is not authoritative for the domain. Fix the problem by confirming who hosts DNS and mail, repairing OpenDKIM, enabling signing with a known selector, publishing the exact TXT value at selector._domainkey.example.com, and testing the record from the public DNS path.
How DKIM works in a Virtualmin setup
DomainKeys Identified Mail (DKIM) adds a cryptographic signature to outgoing email. The mail server keeps a private key and signs each message. Receiving systems retrieve the matching public key from DNS and use it to verify that the message was signed by the domain and was not altered in transit.
The DNS name contains the selector chosen for the signing key: selector._domainkey.example.com. The selector appears in the message’s DKIM-Signature header as the s= value, while the signing domain appears as d=. A mismatch in either value can make a correctly formatted DNS record appear to be missing or invalid.
- Private key: stored on the server and used by OpenDKIM when Virtualmin signs mail.
- Public key: published as a DNS TXT record and retrieved by receiving mail systems.
- Selector: identifies which key pair is active, allowing several keys to coexist during rotation.
- DNS authority: the nameservers delegated for the domain determine which TXT record the public Internet sees.
Virtualmin documentation states that all email relayed through Virtualmin is signed when DKIM is activated for that domain. Activation therefore has two separate parts: configuring the signer on the server and publishing the corresponding public key where the domain’s authoritative DNS is served.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
1. Confirm which system controls DNS and mail
Before editing a zone, identify the actual architecture. Virtualmin may host both services, or mail may run on the Virtualmin server while DNS is hosted elsewhere. DNS records in a local BIND zone are publicly useful only when the domain’s delegated nameservers point to that BIND installation.
Check the mail path
- Determine whether the domain’s outgoing mail is relayed through the Virtualmin/Postfix path. Messages sent through another SMTP service will use that service’s DKIM configuration instead.
- Use a test message with full headers later in the process. The
d=ands=values reveal which domain and selector actually signed the message.
Check DNS authority
Find the nameservers delegated for the domain at the registrar. If they belong to an external DNS provider, publish the DKIM TXT record there, not only in Webmin’s BIND editor. If they point to your server, Webmin’s BIND DNS Server module or Virtualmin DNS tools can update the authoritative zone.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →When lookups fail or different servers return different answers, inspect nameserver delegation and glue records. Webmin’s BIND documentation explains that incorrect nameserver or glue records prevent lookups from reaching the intended server. A local zone-file entry is not evidence of public publication until an external resolver receives the same value from an authoritative nameserver.
2. Install or repair OpenDKIM
Virtualmin needs OpenDKIM (or an existing supported DKIM integration) to create signatures and manage the key configuration. A missing configuration-file error usually means the package is not installed, the module cannot find its files, or the operating system uses a nonstandard package layout.
Install from the Virtualmin interface
- Open Email Messages → DomainKeys Identified Mail. Some interface versions place the control under an equivalent Email Settings page.
- If Virtualmin reports that OpenDKIM is unavailable, select Install Now.
- Allow the module to finish, then reopen the DKIM settings page and verify that the signing controls and key details are available.
Install from a shell
Use the package command for the operating-system family:
- Enterprise Linux systems:
dnf install opendkim - Debian-derived systems:
apt-get install opendkim
Do not assume that installing the package alone enables signing. Return to the Virtualmin domain’s DKIM settings and configure the selector and signing state after installation.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
When installation fails
Review /root/virtualmin-install.log for the original package error. Check repository configuration, network access, package metadata, and any third-party repositories. Virtualmin notes that nonstandard packages can require the Webmin module to be told where configuration files are located; otherwise the package may be present while the module still reports a missing file.
Correct the package or path problem first. Creating a DNS record before the signer can load its private key will not produce a valid signature.
3. Enable DKIM signing and record the selector
DKIM controls appear only for a virtual server with both DNS and email features enabled. If the DomainKeys page is missing, edit the virtual server’s feature selections before troubleshooting the key.
Use the Virtualmin GUI
- Choose the affected virtual server.
- Open Email Settings → DomainKeys Identified Mail (or the equivalent Email Messages → DomainKeys Identified Mail page).
- Set Signing of outgoing mail enabled? to Yes.
- Enter a selector, such as a year-and-month value, or retain the selector already generated for the domain.
- Save the page and copy the DNS publication instructions exactly as displayed.
The selector you save is the selector that must appear in the DNS hostname. Treat capitalization, punctuation, and every character in the generated key as significant.
Use the Virtualmin CLI
The documented command to enable signing is:
virtualmin set-dkim --enableThe same command accepts options for a selector and key size:
virtualmin set-dkim --select name
virtualmin set-dkim --size bitsReplace name and bits with the selector and key size you intend to use. Incoming verification is separate from outgoing signing. Enable it with --verify, or explicitly leave it disabled with --no-verify:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
virtualmin set-dkim --verify
virtualmin set-dkim --no-verifyBy default, incoming mail is not checked for a valid DKIM signature unless the --verify flag is given. Turning verification off can stop verification-related bounces, but it also removes that check; make the choice deliberately rather than using it as a substitute for repairing DNS.
4. Publish the exact public key in DNS
After signing is enabled, Virtualmin displays the hostname and TXT value to publish. Create the record at:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →selector._domainkey.example.comUse the actual selector configured for the domain. Do not substitute a familiar selector name, the domain apex, or a selector from another virtual server.
Copy the TXT value without alteration
- Keep the complete value supplied by Virtualmin, including the
v=DKIM1andp=fields. - Do not remove punctuation, insert spaces, wrap the value manually, or replace characters that look unusual.
- If a provider displays a long key as several quoted TXT strings, preserve every segment in the provider’s required format. DNS clients concatenate these strings when returning the TXT value.
A key from a previous selector or rotation will not validate mail signed with the new private key. Publish the key generated for the active selector.
Publish on external DNS
If the domain’s nameservers point to an external DNS provider, create a TXT record in that provider’s zone editor. Webmin can edit a local BIND zone, but public resolvers will continue to query the delegated provider until nameserver delegation changes.
Publish on local BIND
When your server is authoritative, add the record through Webmin’s BIND DNS Server module or Virtualmin’s DNS tools. Virtualmin’s modify-dns API supports record name, type, TTL, and value fields, so automation must pass the exact selector hostname, TXT type, and complete key value.
Recommended Free Tools
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Allow for the TTL and provider processing time before judging a newly saved record. Test the authoritative response rather than relying on the zone editor’s confirmation message.
5. Verify the record from the public DNS path
Use command-line lookups to distinguish a malformed record from a delegation problem.
Query the selector record
dig TXT selector._domainkey.example.com
host -t TXT selector._domainkey.example.comReplace the example hostname with the exact selector and domain. The returned TXT data should contain the public key associated with the active private key. If the answer is empty, check the spelling of the selector and confirm that you edited the authoritative provider.
Query authoritative nameservers directly
When ordinary resolvers disagree, query each authoritative nameserver directly. A response from the local BIND service proves only that the local service has the record; a response from the delegated nameserver proves what receiving systems can retrieve.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check delegation and glue
whois example.comUse the result to confirm the registrar’s nameserver delegation. Incorrect nameserver or glue records can send queries to the wrong servers even when the zone file itself is correct.
| Observation | What it usually indicates | Next check |
|---|---|---|
dig returns the expected key |
The public TXT record is reachable for that selector. | Send a test message and compare its s= and d= values. |
| Local BIND returns the key, public lookup does not | BIND is not authoritative, or delegation/glue points elsewhere. | Inspect delegated nameservers with whois and query them directly. |
| A different key is returned | A stale selector record, wrong provider, or old rotation is being served. | Compare the returned value with the key currently shown by Virtualmin. |
| No TXT answer for the selector | Selector typo, missing record, or DNS provider has not published the change. | Recheck the exact hostname and the authoritative zone. |
6. Confirm that messages are being signed
Send a test message through the same Virtualmin mail path used by the affected domain. Open the recipient’s full headers and locate DKIM-Signature.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
- Read
s=and query that selector’s DNS name. - Read
d=and confirm it is the domain you intended to sign. - Compare the queried public key with the key displayed in Virtualmin for the active configuration.
If the header is absent, signing may still be disabled, OpenDKIM may not be installed or configured, or the message may have bypassed the configured Postfix path. Recheck the signing setting and package installation before changing DNS.
If the header uses an old selector after a planned rotation, either keep the old selector’s TXT record published until every sender uses the new selector or remove the stale configuration through the documented Virtualmin controls. Deleting the old record immediately can invalidate messages still signed with it.
7. Choose the right operating model
| Decision | Webmin/Virtualmin-managed BIND | External DNS provider |
|---|---|---|
| Where the TXT record is created | Webmin’s BIND DNS Server module or Virtualmin DNS tools. | The provider serving the domain’s delegated nameservers. |
| Main advantage | DNS and mail changes can be managed on the same server. | DNS changes remain independent of the mail host and can be managed by a separate team. |
| Main risk | Local records are invisible if delegation or glue points elsewhere. | Editing Virtualmin’s local zone has no public effect when another provider is authoritative. |
| Best verification | Query the delegated nameservers, not only localhost. | Use the provider’s zone editor, then confirm with dig and host. |
| Control method | Best fit | Important distinction |
|---|---|---|
| Virtualmin GUI | One-off setup and administrators who need the generated DNS instructions. | Labels expose the signing state and selector, but the record may still need to be entered at an external DNS provider. |
virtualmin set-dkim |
Repeatable administration and scripted changes. | Options such as --select, --size, --verify, and --no-verify must be applied deliberately. |
| Mail policy | Effect | Operational consideration |
|---|---|---|
| Signing only | Outgoing messages receive DKIM signatures. | Incoming messages are not checked by Virtualmin unless verification is enabled. |
| Signing plus incoming verification | Outgoing mail is signed and incoming signatures are checked. | Monitor verification-related bounces and keep the DNS keys available for every active selector. |
8. Selector and key rotation without breaking mail
A selector lets you publish a replacement key while the previous key remains available. Choose a naming convention that identifies the rotation period, such as a year-and-month value, and record which selector Virtualmin is using for each domain.
- Create or select the new key and selector in Virtualmin.
- Publish the new selector’s TXT record at the authoritative DNS provider.
- Verify the new record with
digorhost. - Send a test message and confirm that its
s=value is the new selector. - Retain the previous selector while any sender can still produce signatures with it.
- Remove the old record only after the old signing configuration is no longer used.
Do not change the selector in Virtualmin and then continue testing the old DNS hostname. The DNS query must always be built from the selector shown in the current DKIM-Signature header.
9. Diagnose the common failure messages
| Symptom | Likely causes | Focused remedy |
|---|---|---|
| No DKIM signature | Signing is disabled, OpenDKIM is missing or not configured, or the message bypassed the configured mail path. | Check the Virtualmin signing setting, OpenDKIM installation, and the message’s outbound route. |
| DKIM record not found | Selector typo, missing TXT record, wrong DNS host, or nameserver delegation problem. | Derive the hostname from the header’s s= value, then run dig, host, and whois. |
| Public key does not match | DNS contains an old key or the TXT value was copied incorrectly. | Republish the complete key generated for the active selector and verify the public response. |
| Record visible locally but not online | BIND is not authoritative, glue or NS delegation is wrong, or an external provider serves the zone. | Publish at the delegated provider and test its authoritative nameservers. |
| Virtualmin cannot create DKIM configuration | Package or repository failure, missing configuration path, or unsupported nonstandard package layout. | Inspect /root/virtualmin-install.log, correct repositories and paths, then retry the module setup. |
| Long key appears split into TXT strings | The DNS editor is representing one long value as multiple strings. | Preserve every string exactly as required by the provider and verify the concatenated result with dig. |
10. A complete recovery checklist
- Confirm the domain’s authoritative nameservers and whether Virtualmin handles its mail.
- Ensure the virtual server has both DNS and email features enabled.
- Install OpenDKIM with Virtualmin’s Install Now action,
dnf install opendkim, orapt-get install opendkim. - Enable outgoing signing and write down the exact selector.
- Copy the complete
v=DKIM1/p=TXT value from Virtualmin. - Publish it at
selector._domainkey.example.comon the authoritative DNS service. - Run
dig TXTandhost -t TXTagainst the public DNS path. - Use
whoiswhen delegation or glue records are questionable. - Send a test message and compare the header’s
s=andd=values with the DNS record. - Keep old selector records during a controlled rotation until no sender uses them.
Following the checklist separates server-side signing failures from DNS publication failures. The decisive test is always the combination of a real DKIM-Signature header and a matching public TXT response from the domain’s authoritative nameserver.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
