Fixing DKIM Signatures That Fail Verification

Introduction

A DKIM signature failure means the receiving mail server could not verify the cryptographic signature on your message. DKIM adds a digital signature to outgoing email so receivers can confirm the message was not altered in transit and that it was signed by a holder of the private key matching your published public key.

DKIM failures are usually caused by a missing or incorrect DNS record, the wrong selector, signing disabled on the mail server, a provider key rotation not reflected in DNS, or message modification by forwarding services. Fixing DKIM requires matching the selector, DNS record and signing configuration to your actual sending provider.

Quick answer

What DKIM signature fail means

DKIM uses a key pair. Your mail provider signs each message with a private key. The matching public key is published in DNS at a hostname built from the selector and your domain: selector._domainkey.example.com. Receivers fetch that record and verify the signature in the message headers.

When verification fails, one of these is usually wrong:

• the selector in the message does not match any published DNS record
• the TXT or CNAME record is missing or published on the wrong hostname
• the public key in DNS does not match the private key signing mail
• DKIM signing is disabled in the mail provider or server settings
• the provider rotated keys but DNS still shows the old public key
• the message body or signed headers were modified after signing
• email forwarding altered content and broke the signature
• a CNAME points to the wrong target or a TXT record is truncated
• multiple providers sign with different selectors but only one is in DNS

TXT and CNAME records both work for DKIM. Google Workspace and many hosts use TXT records with the public key inline. Services like SendGrid, Mailgun and Amazon SES often use CNAME records that point to the provider’s hosted key. Always follow your provider’s exact format.

TXT record:
default._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC..."

CNAME record:
s1._domainkey.example.com CNAME s1.domainkey.u123456.wl.sendgrid.net

Why this matters

DKIM also helps receivers detect tampering. A valid signature tells them the message content and key signed headers were not changed after your provider sent it.

How to check

Compare message headers, your mail provider settings and live DNS records.

1. Send a test email from the affected service to a mailbox you control.
2. Open message headers and find the DKIM-Signature header.
3. Note the selector (s=), signing domain (d=) and result (dkim=pass or fail).
4. Run DKIM Checker with the correct selector and domain.
5. Confirm a TXT or CNAME record exists at selector._domainkey.yourdomain.com.
6. Compare the public key in DNS with the value shown in your provider admin panel.
7. Verify DKIM signing is enabled in your email provider or MTA settings.
8. Check whether the message was forwarded — forwarding often breaks DKIM.
9. Review recent provider key rotations or DNS migrations.
10. After DNS changes, wait for propagation and send another test.

Common problems

How to fix

1. Step 1: Read the DKIM-Signature header

   Send a test message and note the selector (s=), signing domain (d=) and whether dkim=pass or fail.

2. Step 2: Run DKIM Checker

   Enter your domain and the selector from the header to see whether DNS publishes a valid public key.

3. Step 3: Enable signing in your provider

   Turn on DKIM signing in Google Workspace, Microsoft 365, SendGrid, Mailgun or your hosting mail panel.

4. Step 4: Publish the DNS record

   Add the TXT or CNAME record at selector._domainkey.yourdomain.com using the exact value from your provider.

5. Step 5: Handle key rotation

   When providers rotate keys, add the new record before removing the old one to avoid verification gaps.

6. Step 6: Fix website and plugin mail

   Configure WordPress SMTP plugins to send through a provider that signs DKIM for your domain.

7. Step 7: Test after propagation

   Wait for DNS to update, send another test and confirm dkim=pass in received message headers.

8. Step 8: Confirm DMARC alignment

   Verify the signing domain aligns with your From domain so DMARC can pass on the DKIM axis.

Examples

Problem:
dkim=fail (signature verification failed)

Headers show:
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=google; ...

DNS check:
dig google._domainkey.example.com TXT → no result

Cause:
DKIM signing is enabled in Google Workspace
but the google selector TXT record was never published.

Fix:
Copy the TXT record from Google Admin → Apps → Google Workspace → Gmail → Authenticate email.
Publish at google._domainkey.example.com.

Verify:
Run DKIM Checker with selector "google".
Send test → headers show dkim=pass.

Frequently asked questions