DKIM signature missing
Messages leave without a verifiable DKIM signature.
Problem summary
Messages leave without a verifiable DKIM signature.
Symptoms
- No DKIM-Signature header on outbound mail
- dkim=none in Authentication-Results
- DMARC cannot pass via DKIM
Possible causes
- Signing not enabled on the stream
- Wrong domain selected for signing
- Message injected through a path that bypasses the signer
How to diagnose
- Inspect a raw outbound message for DKIM-Signature
- Confirm ESP/MTA DKIM is enabled for the From domain
- Verify the sending path actually hits the signing service
How to fix
- Enable DKIM for the domain/stream and republish selector DNS if needed
- Route mail through the signing MTA/ESP
- Add a second signer only with a clear selector plan
How to verify
- Outbound tests include DKIM-Signature
- Receivers report dkim=pass for the intended d=
Prevention
- Gate production sends on a signed test message checklist
- Alert when signed volume drops to zero
When to escalate
- Production mail is failing for a material share of recipients after remediation attempts