diff --git a/filtermail/src/dkim_verifier.rs b/filtermail/src/dkim_verifier.rs
index 7fc62938..6b8a42aa 100644
--- a/filtermail/src/dkim_verifier.rs
+++ b/filtermail/src/dkim_verifier.rs
@@ -95,6 +95,12 @@ impl LookupTxt for CachedResolver {
                 lookup
                     .answers()
                     .iter()
+                    .filter(|record| {
+                        // Select only TXT records.
+                        // When resolving TXT query, CNAMEs are also returned as answers.
+                        // We want to filter out CNAMEs first.
+                        matches!(record.data, hickory_resolver::proto::rr::RData::TXT(_))
+                    })
                     // We don't check all records, as this can be a DoS attack vector.
                     // In theory, selector domains should only have a single TXT record.
                     // In practice, we check at most 3, just in case of weird configuration.