DKIM verification failure
Receivers cannot validate the DKIM signature.
Problem summary
Receivers cannot validate the DKIM signature.
Symptoms
- dkim=fail for reasons other than missing selector
- Signature present but does not validate
- Clock skew or header canonicalization issues suspected
Possible causes
- Header fields covered by h= were altered
- Wrong public key for the active private key
- Partial MIME changes or transfer encoding shifts
How to diagnose
- Validate with a DKIM verifier against the published key
- Diff signed header set between send and receive
- Confirm selector matches the active signing key
How to fix
- Align DNS key with the active signer; rotate cleanly if mismatched
- Prevent intermediaries from rewriting signed headers
- Adjust canonicalization only with a clear test plan
How to verify
- Verifier and receiver both report dkim=pass
- Stable pass rate in DMARC aggregates
Prevention
- Treat signed header lists as part of change control
- Canary-send after MTA upgrades
When to escalate
- Production mail is failing for a material share of recipients after remediation attempts