DKIM signature expired
Your DKIM signature contains an x= tag with a timestamp in the past. Receivers reject expired signatures.
Expired signatures are treated as invalid. Same effective impact as a signature failure: deliverability degrades, DMARC via DKIM fails.
What causes it
- You configured a short x= expiration (e.g., 7 days) and the message sat in a queue longer than that before delivery.
- Your mail server's clock drifted and the x= value was wrong at signing time.
- A legitimate replay delay (e.g., mailing list digest) pushed the message past expiration.
How to fix it
Step 1: Remove the x= tag entirely
RFC 6376 makes x= optional. For most senders, having no expiration is simpler and avoids this class of error. Set your signer to not include x=.
Step 2: If you need x=, use a longer window
If you have a specific security reason to expire signatures (e.g., preventing long-term replay attacks), use 30 days minimum. Most mail round-trips in minutes; 30 days is a safe cushion.
Step 3: Verify server clock accuracy
Run timedatectl status on your mail server. If NTP sync is off, the signing timestamp will be wrong. Enable chrony or systemd-timesyncd and point to pool.ntp.org.
Fixed it? Run a fresh test to confirm.
Test my inbox →