Short answer
DKIM fails when the receiving server can't verify the signature on a message: either the message changed after it was signed, or the public key in DNS is missing, broken or doesn't match the key that signed it. The reason in the Authentication-Results header tells you which.
Messages you send directly are fixed in DNS or in your sending setup. Messages broken by a forwarder or mailing list usually can't be fixed from your side.
Find the reason in your headers
Open the original message (in Gmail, the three-dot menu, then Show original) and look for the Authentication-Results header your receiving server added. A failure looks like this:
Authentication-Results: mx.example.net;
dkim=fail (body hash did not verify) header.d=example.com header.s=s1;
spf=pass smtp.mailfrom=bounces.example.com;
dmarc=fail action=none header.from=example.comheader.dis the domain that signed. For DMARC it must match your From domain.header.sis the selector: the key lives ats1._domainkey.example.com.- The text in brackets is the reason. Wording varies by receiver; the next section maps the common ones.
Headers hard to read? Paste them into the email header analyzer and it pulls out each result.
Each failure reason, its cause and the fix
| Reason | What it means | Usual causes | Fix |
|---|---|---|---|
body hash did not verify | The body is different from what was signed. | A mailing list or gateway added a footer or disclaimer; a forwarder re-encoded the message; a relay rewrote links; lines over 998 characters were wrapped in transit. | For mail you send directly, make sure nothing edits the message after it's signed (signing should be the last step) and keep HTML lines short. For forwarded mail, see forwarding. |
signature did not verify / bad signature | The signed headers changed, or the key in DNS doesn't match the key that signed. | A gateway edited the Subject or From; the DNS key is from before a key rotation; the record was pasted with a typo or a missing piece. | Compare the DNS record with your provider's current value and publish it exactly. If only one recipient's gateway breaks it, that gateway is editing headers. |
no key for signature / key not found | The receiver looked up the selector in DNS and found nothing. | The record isn't published; the selector is wrong; your DNS host appended your domain again, so the record sits at s1._domainkey.example.com.example.com. | Publish the record at exactly the name your provider gives, and check it with dig or the DKIM checker before re-sending. |
key syntax error / invalid public key | The record exists but can't be read as a DKIM key. | The key was cut off at 255 characters, line breaks or extra quotes were pasted in, or the p= part is missing. | Re-paste the value as one string and let your DNS host split it, or split it into quoted 255-character chunks with nothing between them. |
signature expired | The signature's expiry (x=) had passed when the message arrived. | The message sat in a queue or was retried for a long time after signing. | Usually a one-off. If it repeats, look for messages delayed in your own queue before sending. |
dkim=pass with dmarc=fail | DKIM verified, but for a domain that isn't your From domain. | Your provider signs with its own domain instead of yours. | Add your provider's DKIM records for your sending domain so it signs as you. See alignment. |
Check the key in DNS
Most failures on mail you send yourself come down to the DNS record. Look it up with the selector from the header and compare it to the value your email provider gave you:
$ dig +short TXT s1._domainkey.example.com
"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx3k..."
"...Q2y8ZJ5mK1vN4wT7rL0pB6sD9fG2hX5cV8bN1mQ4eR7tY0uI3oP6aS9dF2gH5jK"- No answer? The record isn't published at that name. Check the selector, and that your DNS host didn't add your domain twice.
- Several quoted strings? That's normal. A 2048-bit key is longer than the 255-character limit of one TXT string, so it's split, and receivers join the pieces.
- Different from your provider's value? A key was rotated or pasted wrong. Publish the current value exactly.
Forwarding and mailing lists
If DKIM passes when you email a mailbox directly but fails once the message goes through a forwarding address, a mailing list or a security gateway, the message was changed on the way: a footer added, a subject tag like [EXTERNAL], links rewritten. Nothing in your DNS will fix that.
Many forwarders and receivers use ARC to record that the message passed authentication before they changed it, and large mailbox providers take that into account. If those failures show up in your DMARC reports, keep your DMARC policy at p=none until your own sources pass, then tighten it. SPF, DKIM and DMARC for transactional email covers a safe rollout.
DKIM passes, but DMARC still fails
A dkim=pass only counts for DMARC when the signing domain lines up with your From domain. If your provider signs with its own domain, the header shows dkim=pass header.d=provider.com next to dmarc=fail for your domain.
The fix is to have your provider sign with your domain: add the DKIM records it gives you for your sending domain. Groundmail signs with your own domain once you add its records, and the domain page shows when DKIM is live.
How to check DKIM is working
- 01Send a real messageSend one from your app to a Gmail address you control.
- 02Open the originalOpen it and choose Show original.
- 03Read the DKIM lineLook for DKIM: PASS with domain followed by your own domain. Another domain there means your mail isn't aligned yet.
- 04Check the key directlyOr put the selector and domain into the DKIM checker to confirm the key is published and valid.
Frequently asked questions
What is DKIM authentication?
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each email. The receiving server fetches your public key from DNS and checks the signature, which proves the message came from your domain and wasn't changed on the way.
What does it mean when an email is rejected per DMARC policy?
The receiver checked SPF and DKIM, neither passed for a domain matching your From address, and your DMARC policy says to reject. Fix whichever check is failing for your own mail before loosening the policy.
How do I enable DKIM for my domain?
Your email provider generates the key pair and gives you a TXT or CNAME record to publish under a selector at your DNS host. Once it's live, the provider signs your mail with it.
Does a DKIM failure always mean the email goes to spam?
No. A single failure on a forwarded message is common and receivers allow for it. Repeated failures on mail you send directly hurt deliverability and break DMARC, so fix those first.
Sources
Facts on this page about other companies' products, prices and policies come from these public pages. They change, so check them before you decide.