Why does MXToolBox say my DKIM Signature is not verified?
Summary
What email marketers say9Marketer opinions
Email marketer from Email on Acid shares that incorrect syntax in the DKIM DNS record, such as missing semicolons or incorrect key values, can lead to verification failures. Suggests using online tools to validate the DKIM record syntax.
Email marketer from SuperUser explains that using the wrong DKIM selector in the signing process or when querying the DNS record can cause verification failures. It suggests verifying that the selector used matches the one specified in the email headers.
Marketer from Email Geeks shares that others have reported a glitch with MXToolBox. Mentions Email Stuff finds no issues with DKIM.
Email marketer from Mailhardener answers that if DKIM fails for subdomains it is commonly due to incorrect subdomain delegation or missing DKIM records for specific subdomains. You need to configure individual DKIM records for each sending subdomain.
Email marketer from AuthSMTP explains that invalid characters or formatting issues within the DKIM record can cause verification issues. They advise checking the record for any typos or special characters that may be interfering with the verification process.
Email marketer from Reddit suggests that MXToolbox can sometimes report false positives regarding DKIM failures, and it's recommended to verify with other tools before taking action. Suggests checking the raw email headers for authentication results.
Email marketer from StackOverflow answers that DKIM verification failures can sometimes be caused by line breaks or whitespace issues in the email header or body, especially after the message passes through different mail servers.
Email marketer from MXToolbox Forum answers that DNS propagation delays after updating the DKIM record can cause temporary verification failures. It is suggested to wait 24-48 hours for the changes to fully propagate.
Email marketer from DigitalOcean community answers that having multiple DKIM records can sometimes cause conflicts or validation errors, especially if they are not properly configured. Proper management and separation of DKIM keys are important for each sending domain.
What the experts say5Expert opinions
Expert from Email Geeks responds that the DNS record is syntactically correct and all tools agree. The signature may not be, but only mxtoolbox has seen that.
Expert from Spamresource explains that DNS record errors, such as incorrect syntax, typos, or improper key placement, are common reasons for DKIM verification failure in MXToolbox. They advise carefully validating the DKIM DNS record using online tools to ensure correctness.
Expert from Email Geeks explains there is whitespace in the body hash in the DKIM signature as reported at mxtoolbox. Suggests it could be a copy/paste issue or header unfolding issue, but probably not a concern unless there are actual problems.
Expert from Spamresource explains that if the DKIM selector in the email header does not match the selector used to generate the DKIM key pair, MXToolbox will report a DKIM verification failure. They suggest ensuring the email sending software uses the correct selector.
Expert from Word to the Wise responds that even if a particular vendor flags DKIM problems, it's vital to see if other vendors also flag the same issue. Checking authentication at multiple receivers is crucial.
What the documentation says6Technical articles
Documentation from AWS explains that there are keysize limitations for DKIM, and that if the key size in the DKIM record exceeds these limits it may cause validation errors. Key sizes of 1024 or 2048 bits are most commonly used.
Documentation from OpenDKIM.org details troubleshooting DKIM issues which often involve verifying the selector in the DKIM record matches the one used for signing, and ensuring the public key in the DNS record matches the private key used for signing.
Documentation from Microsoft explains that incorrect DKIM configuration, including errors in the DNS record or key mismatch, can cause their email authentication checks to fail. It recommends ensuring the DKIM record is correctly published and validated.
Documentation from RFC Editor explains that DKIM signature verification can fail for various reasons, including signature manipulation during transit, incorrect key retrieval, or problems with the signing process itself.
Documentation from DKIM.org explains that common causes of DKIM failure include incorrect DNS configuration, changes to the message body after signing, and problems with the DKIM signing software.
Documentation from SendGrid provides a guide for testing and troubleshooting DKIM issues. Ensuring correct DNS configuration, verifying the DKIM record, and checking for common issues like syntax errors are recommended. They also suggest using SendGrid's own tools to diagnose DKIM issues.