DKIM and DMARC kept failing after I moved my domain to Cloudflare. The DNS import was the problem

So I was setting up email on my own domain with Zoho. Added SPF, DKIM, DMARC exactly like the docs said. Checks still failing.

Problem was Cloudflare's onboarding scan. When you add a domain it imports the existing records, and mine was parked on Namecheap, so it copied all the parked-domain junk:

-> NS records on _dmarc and _domainkey pointing to failed-whois-verification.namecheap.com
-> a DMARC with p=reject
-> an empty *._domainkey key
-> 2 SPF records (only 1 allowed, 2 = SPF fails)

The NS ones are the killer. If _domainkey is delegated somewhere else, nobody even looks at your DKIM record, doesn't matter how correct it is.

Deleted the whole zone and added everything again by hand. Gmail headers now show spf=pass, dkim=pass, dmarc=pass 😀

2 small things that also got me:
-> Zoho's default DKIM selector is zmail, not zoho
-> start DMARC at p=none with a report address, see what fails, then tighten it

tldr: records look right but checks still fail? Run dig NS _domainkey.yourdomain.com first.