Why are some SFMC emails failing DKIM and causing DMARC rejections?
Summary
What email marketers say10Marketer opinions
Email marketer from Stack Overflow responds that SFMC uses multiple IPs for sending and it's possible that not all IPs are configured with DKIM, or that the DKIM configuration is incomplete. This can cause intermittent DKIM failures.
Email marketer from Email on Acid explains that lack of DMARC monitoring and reporting prevents senders from seeing the root causes of failures. Analyzing DMARC reports is crucial to diagnose DKIM and SPF alignment issues in SFMC.
Email marketer from SuperOffice responds that not fully understanding the email authentication process is a common mistake and this leads to misconfigurations. You need to learn about SPF, DKIM and DMARC to correctly identify and fix email authentication issues.
Email marketer from Salesforce Marketing Cloud Community shares that ensuring DKIM keys are properly generated, uploaded, and activated within SFMC is crucial. Incorrect key setup will lead to DKIM failures.
Email marketer from Mailgun answers that ensuring that the sending domain is properly configured and verified within SFMC is crucial. An unverified domain may lead to sporadic authentication issues.
Email marketer from Reddit suggests that SFMC might be sending emails from subdomains or domains that are not properly aligned with your SPF records, leading to DMARC failures even if DKIM passes.
Marketer from Email Geeks shares an anecdote about a client who consistently sees a tiny percentage of their emails from SFMC go out without DKIM or from a random pool IP, and they have never been able to figure out why.
Email marketer from Litmus shares that shared IPs in SFMC can have fluctuating reputations. If the IP sending your email has a poor reputation, even passing DKIM can be impacted as ISPs might be more stringent.
Email marketer from SendGrid answers that using an insufficient DKIM key size (e.g., less than 1024 bits) can cause DKIM failures, especially with stricter ISPs. SFMC's DKIM setup should use an adequate key length.
Email marketer from Postmark answers that publishing a DMARC record to request reports on authentication results from receivers is a very important step to take, as it will provide insights into potential DKIM failures.
What the experts say5Expert opinions
Expert from Spam Resource answers that DKIM is an important factor for email deliverability. Without it, emails are more likely to land in the spam folder, and can result in DMARC rejections.
Expert from Spam Resource answers that weak DKIM keys are a cause of DKIM validation issues. Use a minimum of 1024 bits, with 2048 bits recommended.
Expert from Word to the Wise answers that one of the causes of DKIM validation fails is misconfigured domain DNS records. If the DNS records are not correctly configured, it leads to DMARC rejections.
Expert from Email Geeks responds that you probably shouldn’t be at reject if you can’t send with domain alignment, and if DKIM were aligned it would probably be fine.
Expert from Email Geeks explains that you really shouldn’t be using DMARC at anything beyond p=none if you don’t have enough control over your mailstreams to have aligned SPF in place. It is also an ESP issue in that you’re paying them to manage this.
What the documentation says4Technical articles
Documentation from DMARC.org details that DMARC failures arise when neither SPF nor DKIM authentication align with the domain in the 'From' address. Even if one passes, it must align. Alignment issues cause rejections.
Documentation from RFC 822 responds that certain email formatting issues, such as violations of RFC 822 standards (e.g., malformed headers), can cause issues with email authentication, including DKIM failures.
Documentation from Mailjet responds that incorrect DNS records for DKIM are a common cause of failure. The DNS record must exactly match what the ESP (SFMC) provides, and DNS propagation delays can temporarily cause issues.
Documentation from Salesforce explains that DKIM failures can occur if the signing domain in the DKIM signature doesn't match the domain in the 'From' address. Proper domain alignment is necessary for DKIM to pass DMARC checks.