DKIM body hash mismatch
Body modifications invalidate the DKIM body hash.
Problem summary
Body modifications invalidate the DKIM body hash.
Symptoms
- dkim=fail with body hash mismatch
- Failures after open-tracking, click wrapping, or footer injection
- MIME alterations between signer and receiver
Possible causes
- Content modified after signing
- Wrong canonicalization for the mutation pattern
- Intermediate gateway rewriting bodies
How to diagnose
- Compare a copy captured immediately after signing vs at the receiver
- Identify which hop alters content
- Check whether l= body length tagging is involved
How to fix
- Sign after final content mutations, or stop mutating signed parts
- Move tracking/footer injection before the DKIM signer
- For unavoidable rewrites, resign at the rewriting hop with aligned d=
How to verify
- End-to-end path no longer breaks bh=
- dkim=pass at major receivers
Prevention
- Document the ordered pipeline: mutate → sign → send
- Regression-test DKIM after marketing template changes
When to escalate
- Production mail is failing for a material share of recipients after remediation attempts