Why a DKIM selector lookup fails
A DKIM key is not published at the root domain. It is found at selector._domainkey.example.com, and the selector is chosen by the sending service. Testing default, google, selector1, or s1 at random may miss a valid key with a different name.
A not-found result can also mean the provider expects a CNAME instead of a TXT record, the DNS host was entered twice, or signing has not been enabled after the DNS record was added.
Find the selector used by real mail
Open the raw source of a message sent by the affected platform and find the DKIM-Signature header. The s= value is the selector and the d= value is the signing domain. Test that exact pair rather than guessing.
You can also copy the selector from the provider's domain-authentication screen. Preserve the record type and target exactly; a CNAME target should not be converted into a TXT public key.
Verify signing and alignment
After DNS resolves, send a new message. Confirm dkim=pass in Authentication-Results and compare the d= domain with the visible From domain. A valid key can still fail DMARC when the signing domain is unrelated and does not align.