Where you saw it: Authentication-Results showing dkim=fail with a reason such as signature did not verify, or a DMARC report where DKIM fails while SPF passes.
Why it happens
- Something modified the message in transit. A mailing list that appends a footer, a security appliance that rewrites links, or a gateway that adds a disclaimer all break the signature.
- The published public key no longer matches the private key doing the signing, usually after a key rotation that changed one side only.
- The key was published with line breaks or whitespace inside the p= value, which DNS stored faithfully and the verifier cannot parse.
- The signature covers a header that the sending path later rewrites, most often the Subject line or a From display name.
- Character encoding changed between signing and delivery, which alters the body hash without changing anything a human would notice.
The fix, in order
Fetch the published key and read it
Run dig +short TXT selector._domainkey.yourdomain.com using the selector from the failing message's DKIM-Signature header. The p= value should be one continuous base64 string.
Strip whitespace from the published record
If the key was pasted across several lines, republish it as a single unbroken value. This is the most common cause of a key that looks correct and does not work.
Compare selectors
The s= field in the failing message names the selector the signature used. If that selector is not in DNS, or points at an old key, you have found the mismatch.
Test a direct send, bypassing every intermediary
Send from your platform straight to a mailbox you control with no list, no gateway and no forwarding. If that passes and the real path fails, something in between is modifying the message.
Identify the modifier and stop it signing over changed content
Disclaimers, footer injection and link rewriting all break DKIM by design. Either move that step ahead of signing, or accept the break and make sure SPF alignment carries DMARC on its own.
dig +short TXT s1._domainkey.example.comThe selector comes from the s= field of the failing signature.
How to know it worked
The short version
- Authentication-Results on a test message reads dkim=pass with your domain in the d= field.
- DMARC aggregate reports show the DKIM column passing for that sending source.
- Send through the real path, including any list or gateway, rather than only a direct test.
Questions people ask
Why does DKIM fail only on messages to a mailing list?
Because lists modify messages. Appending a footer or rewriting a subject line changes the content the signature covers, so the hash no longer matches. This is expected behavior rather than a fault in your setup.
Does a failing DKIM signature mean the message is rejected?
Not on its own. If SPF passes and aligns, DMARC still passes. It becomes a rejection when both mechanisms fail and your policy says reject.
How do I rotate a DKIM key safely?
Publish the new public key at a new selector, switch the platform to sign with that selector, confirm passes for a few days, then remove the old record. Never overwrite a live selector.