DKIM signature invalid

Your DKIM signature is present but failed verification — the message was modified in transit or your signing config is broken.

Impact — High impact

A failed DKIM signature downgrades your deliverability significantly. If you also have a DMARC policy of quarantine or reject, your mail will land in Junk — or not land at all.

What causes it

Mailing list software (Mailman, Listserv, newsletter platforms) modified the body or headers after signing. The signature no longer matches the content.
Your signing key doesn't match the public key in DNS. You rotated keys but forgot to update the DNS selector record, or vice versa.
Wrong canonicalization algorithm. Your signer used simple canonicalization but the receiver's parser is strict about whitespace.
Content-Transfer-Encoding mismatch. An intermediate hop decoded or re-encoded the body (base64 ↔ quoted-printable).
Clock skew. The signing time (t=) is too far in the future.

How to fix it

Step 1: Verify your DNS record exists and matches

Run this and compare the returned public key to what your mail server is signing with. If missing or truncated, that is your problem.

dig TXT selector._domainkey.yourdomain.com

Step 2: Check your signing configuration

Platforms where DKIM breaks most often: Microsoft 365 (requires per-domain opt-in in Defender admin center, default is OFF), Google Workspace (generate key, publish DNS record, wait 48 hours before clicking "Start authentication"), Postfix+OpenDKIM (check /etc/opendkim/KeyTable and selector naming).

Step 3: Test again

Once the DNS or signing config is fixed, run a fresh test. If DKIM still fails, the issue is further upstream — check whether a mail gateway (Barracuda, Mimecast, Proofpoint) is modifying messages after signing.

Fixed it? Run a fresh test to confirm.

Test my inbox →