DKIM Signature Did Not Verify (dkim=fail): Causes and Fixes

A DKIM failure means the receiver found a signature on the message, fetched the public key from your DNS, and the two did not agree. The authentication (proof that email really comes from your company)-Results header says which part disagreed, and that word decides the fix. "Body hash did not verify" means the message changed after it was signed. "Signature verification failed" or "no key" means the DNS side is wrong. Here is how to read it and what to do in each case.

Quick answer

Open the message at the receiver, show the original source, and find the dkim= result and the reason in brackets. No key or a verification failure: check the TXT records (short text lines in DNS used for email security) at selector._domainkey.yourdomain.com, where selector is the s= value in the DKIM-Signature header; it is usually missing, truncated or for an old key. Body hash did not verify: something between the sender and the receiver altered the message, most often a footer, a disclaimer or a mailing list.

Read the result

• DKIM (a digital signature that proves your email was not tampered with)=pass: nothing to fix. If mail still lands in spam, the cause is elsewhere.
• DKIM (a digital signature that proves your email was not tampered with)=fail (body hash did not verify): the body was modified after signing. The DNS record is fine.
• DKIM (a digital signature that proves your email was not tampered with)=fail (signature verification failed): the headers were modified, or the public key in DNS does not match the private key that signed.
• DKIM (a digital signature that proves your email was not tampered with)=neutral or dkim=none with "no key for signature" or "key not found": the TXT records (short text lines in DNS used for email security) at the selector does not exist or cannot be read.
• DKIM (a digital signature that proves your email was not tampered with)=permerror: the DNS record exists but is malformed, often a key split across two strings with a missing quote or a stray space.

DNS causes and fixes

1. Record missing. The DKIM-Signature header has s=selector and d=domain. The TXT records (short text lines in DNS used for email security) must exist at selector._domainkey.domain. Copy the exact name and value from your mail provider; OquMail shows both in the dashboard and verifies them live.
2. Record truncated. A 2048-bit key is longer than one 255-character string, and some DNS panels cut it or need it entered as two quoted parts. Our guide to TXT record too long shows the fix per registrar.
3. Wrong selector. Your provider rotated keys and the new selector in the signature has no record yet, or the record is published under an old name. Compare s= in the header with the record name in DNS.
4. Old key still in DNS. After a rotation, the record under the selector holds the previous public key. Replace the value, then wait for the old TTL to expire. See how often to rotate DKIM keys.
5. Two records at the same selector. Some panels keep the old record when you add a new one. Delete one.

Message-modified causes and fixes

1. A footer or disclaimer added after signing. A security gateway, a compliance appliance or the receiving organisation's own filter appended text. Sign after the footer is added, or have the appliance re-sign, or move the disclaimer into the message before it is signed.
2. A mailing list. Lists rewrite subjects and add footers, which breaks the original signature by design. This is expected; DMARC handles it through ARC at good list providers, and you cannot fix it from your side.
3. Line wrapping or encoding changes. Some old relays re-encode the body. Use relaxed canonicalization (c=relaxed/relaxed) at the signer so whitespace changes do not count.
4. Forwarding with modification. A forwarder that adds "FW:" or strips attachments breaks the hash. Forwarding without changes keeps DKIM intact, which is why DKIM survives forwarding while SPF does not.

Confirm the fix

Send a fresh message to a Gmail address, open it, choose Show original, and look for DKIM (a digital signature that proves your email was not tampered with)=pass with your domain in the header.d= part. Gmail also shows the result in plain words near the top of that page. If you changed a DNS record, allow for the old answer to expire from caches first, usually within an hour.

Common questions

Does a DKIM failure mean my mail is rejected?

Not on its own. A receiver treats a failed signature as if the message were unsigned, then looks at SPF and your DMARC policy. With SPF passing and aligned, most mail still arrives. With a DMARC policy of reject and no SPF pass, it does not.

Can I check the DNS record without sending a message?

Yes. Look up the TXT records (short text lines in DNS used for email security) at selector._domainkey.yourdomain.com with any DNS tool and confirm it starts with v=DKIM1 and contains the full p= key in one unbroken string. Our guide to what a DKIM selector is covers finding the selector.

Why does DKIM fail only for some recipients?

Because the modification happens on their side: a gateway at that organisation appends a banner before the verifier runs. Ask their IT team to verify before modifying, or accept it, since their own filter is the one changing the message.

Want to see how your own domain is set up? Use the free SPF checker and DMARC checker: they run in your browser and store nothing.