DKIM body hash mismatch
The DKIM body hash in your signature doesn't match the body as received. Something modified the message after signing.
A body hash mismatch is the strongest indicator that your message was altered in transit. Receivers treat this as a failed signature identical to an invalid signature — delivery penalty is the same.
What causes it
- A mailing list (Mailman, Google Groups) appended a footer or unsubscribe link after signing.
- An email signature appliance (Exclaimer, CodeTwo, Crossware) is adding a signature after your mail server signed.
- A gateway (Barracuda, Mimecast, Proofpoint) is modifying message bodies — common with disclaimer injection or link rewriting.
- Your signer used relaxed/relaxed canonicalization but the body was changed in a way even relaxed can't tolerate (newline added, boundary modified).
How to fix it
Step 1: Identify what modified the body
Look at the Received headers in order. The modification happened between the hop where DKIM was signed and the hop where it was verified. The appliance in that path is your culprit.
Step 2: Move signing to the last outbound hop
If a disclaimer appliance adds a footer, it must do so BEFORE DKIM signing. Reorder your mail flow so the signing hop is the final one before the internet.
Step 3: Alternative — switch to a 3rd-party sender
Transactional email services sign at the sending gateway and have no body-modifying hops in between. If your internal mail flow is too complex to re-order, this is often the easiest fix.
Fixed it? Run a fresh test to confirm.
Test my inbox →