Email Deliverability
DKIM Signature Invalid
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing emails. When the receiving server cannot verify this signature, DKIM validation fails. This weakens email authentication and can cause messages to be flagged as spam, especially when combined with DMARC enforcement.
Symptoms
- DKIM=fail appearing in email headers
- DMARC reports showing DKIM alignment failures
- Emails flagged as suspicious or sent to spam
Common Causes
- DKIM public key not published in DNS or wrong selector
- Email body or headers modified in transit (e.g., mailing list software)
- Key rotation without updating DNS TXT record
- Mismatched signing domain (d= tag) and From: header domain
Step-by-Step Troubleshooting
- 1
Validate DKIM record
Check that the DKIM public key is correctly published in DNS for the signing selector.
Use DKIM Validator → - 2
Check TXT records
Verify the selector._domainkey TXT record exists and contains a valid public key.
Use TXT Record Lookup → - 3
Generate new DKIM keys
Create a fresh DKIM key pair if the existing keys are compromised or misconfigured.
Use DKIM Generator →
Recommended Diagnostic Tools
Monitor DKIM Status
Get notified when DKIM records change or keys expire.