Where you saw it: Authentication-Results with dkim=fail and a reason naming the body hash, which is a more specific diagnosis than a general signature failure.
Why it happens
- A gateway or appliance appended a disclaimer, a confidentiality notice or a scanning footer after your platform signed the message.
- A mailing list added its own footer and unsubscribe block, which is normal list behavior and breaks the hash every time.
- A security product rewrote URLs in the body for click protection, changing bytes the signature covers.
- The canonicalization was set to simple rather than relaxed, which makes the hash fail on whitespace changes that relaxed mode tolerates.
- Content transfer encoding changed somewhere in the path, altering the body's bytes without altering what a reader sees.
The fix, in order
Confirm it really is the body
The failure reason distinguishes a body hash mismatch from a header signature failure. If the reason names the body hash, the key and the headers are fine and you can ignore both.
Send a message that touches nothing else
Send directly from your platform to a mailbox you control, no list and no gateway. A pass here proves the signing is correct and the problem is downstream.
Walk the path and find the modifier
Compare the received body with what you sent. A disclaimer, a footer, a tracking wrapper or a rewritten link is usually visible at a glance.
Sign after the modification, not before
Where you control the gateway, move DKIM signing to the last hop out of your infrastructure. Anything that edits the message should run before the signature is applied.
Switch to relaxed body canonicalization
Relaxed mode tolerates whitespace and line-ending differences that simple mode treats as tampering. It will not survive an added footer, and it removes a whole class of false failures.
How to know it worked
The short version
- A message sent through the full production path shows dkim=pass.
- The body hash reason no longer appears in Authentication-Results.
- DMARC reports show DKIM passing for that source over several days rather than one test.
Questions people ask
What is the difference between a body hash mismatch and a general DKIM failure?
A body hash mismatch tells you the key worked and the content changed after signing. A general signature failure can also mean a wrong key or a rewritten header. The body hash reason is a much narrower diagnosis.
Can I stop mailing lists breaking DKIM?
Not really, and you should not need to. Lists modify messages by design. Make sure DMARC can pass on SPF alignment instead, or use ARC-aware receivers to carry the original result.
Does relaxed canonicalization weaken security?
Marginally, and it is the standard choice for exactly that reason. It tolerates harmless whitespace changes while still detecting content edits.