See what a hostname is an alias for, and follow the chain to whatever it finally points at.
Mail providers hand out CNAMEs for DKIM keys and tracking domains, so a broken alias is a common cause of a signature that silently stops verifying.
A Canonical Name record that points one hostname to another, so both resolve to the same place.
Standard DNS does not allow a CNAME at the apex. Use A/AAAA records or an ALIAS-style record instead.