DKIM 'FAIL' where to dig?

Question

Email

Good time everyone, the second day I'm struggling with DKIM 'FAIL', I have all the records, DKIM checkers all say that it's ok, but the letters fall into spam, the server is behind NAT. I am attaching the original post below. Help what you can)

Delivered-To: [email protected]
Received: by 2002:adf:aac8:0:0:0:0:0 with SMTP id i8csp4322331wrc;
        Mon, 2 Sep 2019 06:48:54 -0700 (PDT)
X-Google-Smtp-Source: APXvYqyG5NCRJvGncYFvJb2YarcW3+2OdOti7YPt1J0qmgjPJamIpk8WFo9UY0g/NTsFynFmLhVz
X-Received: by 2002:a2e:2c14:: with SMTP id s20mr16182031ljs.16.1567432134050;
        Mon, 02 Sep 2019 06:48:54 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1567432134; cv=none;
        d=google.com; s=arc-20160816;
        b=GGuQZ7Xhk83/xOsElOhlmeHhumPP5TFeHQVeZ6bJZ9yIyKBGUFcf3Gs/vSwJ/zKn/d
         QoW/CZB3/epFjsG/RS+qMXgigDbzCmVl3G1uPjoM8Jc7BpUuzhInNesStbB1Pgnbcl5f
         tBCObcKlUiVwMrqezVGz3215kBUCq4exhJjUYAkzrzTk1IxSCPyu+06cePAzQeEkjSK8
         35YGjOF8iydJ2Rmi8IRt8h7SEd/iTF5NE65t1bVmhjUnc/61unE5xhs2/gDzM/SkL919
         vDJjei38x9hcx+zTTeR83Kl+iWFhk9wulpd0XHTGPGAeerMs0K1k1Ph7Rnvqfmd8VdX/
         g1ow==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=message-id:organization:subject:to:from:date
         :content-transfer-encoding:dkim-signature:mime-version;
        bh=q5cyARPl5zX/knmvCnEy11G7/r6gcljJ44qrvv5DErY=;
        b=vNAeTcuM1K0Zy2vtlF+Kr34DjWes9motOOI+LjAywoxDCzta/EEiQy87RX3Ir8E254
         tB/9kkeEplI7oE8J3watN04mTrHHYUiwNtjROqQUPtl03i+0d7MLnyfoz4H/NrtmJz4M
         mLvlQrfJojg47/Bg6lkyZITEfT0BCVGSnt7NThU9cRx1nB2sYQdI8tD6MdVcgsyej4+Z
         mHyUvODhAGPHfW7s32wHcW2m7ipmtm5xIO/3TShseRqOb/P/1j5uOwwNWLftMUwKQbi5
         Ya/sWobn+/J96JWKh2hTt5FH08rohkNr5mXlen+1j3BLiihcUMPffS+/Cw3zZV7tm7ef
         GjqA==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=temperror (no key for signature) [email protected] header.s=mail._domainkey header.b=Ktu9sTEx;
       spf=pass (google.com: domain of [email protected] designates 95.67.9.28 as permitted sender) [email protected];
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=gen-tv.com
Return-Path: <[email protected]>
Received: from mail.gen-tv.com (mail.gen-tv.com. [95.67.9.28])
        by mx.google.com with ESMTPS id u2si12795695lfd.126.2019.09.02.06.48.53
        for <[email protected]>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Mon, 02 Sep 2019 06:48:53 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 95.67.9.28 as permitted sender) client-ip=95.67.9.28;
Authentication-Results: mx.google.com;
       dkim=temperror (no key for signature) [email protected] header.s=mail._domainkey header.b=Ktu9sTEx;
       spf=pass (google.com: domain of [email protected] designates 95.67.9.28 as permitted sender) [email protected];
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=gen-tv.com
MIME-Version: 1.0
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gen-tv.com; s=mail._domainkey; t=1567432131; bh=q5cyARPl5zX/knmvCnEy11G7/r6gcljJ44qrvv5DErY=; h=Date:From:To:Subject; b=Ktu9sTExfU7Wk+zY5VjWkmKUqHSUKYID9w9MiMl9UlEDpVnC7bJ/Ut6LTxeszHOii
   V0fP7khnbSNxroyV79EMqhCIQgCZ3ymZMbfKVdaXFTlw579ODGkCWIJJYFC0O4zprz
   w5T9iip+f29+J/utKdysnB43ND6eeI7BgeDZNDFw=
Content-Type: text/plain; charset=US-ASCII; format=flowed
Content-Transfer-Encoding: 7bit
Date: Mon, 02 Sep 2019 16:48:51 +0300
From: Taras Leitar <[email protected]>
To: [email protected]
Subject: TEST
Organization: Gen-TV
Message-ID: <[email protected]>
X-Sender: [email protected]
X-MailScanner-ID: C1E022E4D.AB658
X-MailScanner: Found to be clean
X-MailScanner-From: [email protected]
X-Spam-Status: No

TEST

Answer 1

You have the wrong selector:
"s=mail._domainkey"
and you need,
"s=mail"
Here you either need to register the DKIM record in DNS as "mail._domainkey._domainkey.gen-tv.com", or change it in the software responsible for the signature DKIM change selector to "mail"

C:\>nslookup -type=TXT mail._domainkey.gen-tv.com
mail._domainkey.gen-tv.com      text =

        "v=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlbTy2wjeJSZopp5zEedveyO9rjE/h8PeoHd6YHKI639qCaNWKVBRL6ByJXgTy+UIHR4pKWI7+vqjsM3C/eRd6INJuMHXlaE2ywGPTmD4Dt6+1gCs9uoQAbisr5/SoGjL+3t+4SEIMe4ozUdPbxTZ0HgjNgVAVKYNjpit9SXlfXMI08fTR/0rLa7aZJkb"
        "0pQ9t2hw7vzwzlAKV3YmiWblnYC1KAgHoiRhxWmKDt94SGx+rkt+hWsUw6he/5T+S3qcBilGVVGV276D36LUQAT7E8MHgRy4M8IqeszP8dZamiYAxUp5s+D1MoY4SGDNq+ToEHt6RqFUrzlBuzXyanaxZQIDAQAB"




C:\>nslookup -type=TXT mail._domainkey._domainkey.gen-tv.com

DNS request timed out.
    timeout was 2 seconds.
*** xxxxxxx can't find mail._domainkey._domainkey.gen-tv.com: Non-existent domain

This is what Google says:
dkim=temperror (no key for signature) [email protected] header.s=mail._domainkey