Why is DKIM failing when sending from Salesforce via Gmail?

Email marketer from EmailOnAcid suggests that Salesforce and Gmail should be properly configured to handle DKIM signatures. If Salesforce is signing the email, Gmail needs to be configured to respect that signature and not alter the email content after it's been signed.

Email marketer from StackExchange explains that forwarding can break DKIM. When an email is forwarded, the content is often modified, causing the DKIM signature to become invalid. When sending from Salesforce via Gmail, Salesforce signs it, but Gmail forwards it on, it breaks the signature.

Email marketer from EmailGeeks discusses that Gmail's SMTP relay can sometimes cause issues with DKIM signatures in Salesforce. The suggested resolution is to ensure that the DKIM keys are correctly configured in both Salesforce and Google Workspace and that no encoding issues are present.

Email marketer from MXToolbox highlights that incorrect DNS settings are a frequent cause of DKIM failure. Verifying that the correct TXT record for DKIM is properly configured in the DNS settings for the domain and that it has fully propagated.

Email marketer from Litmus explains to perform a full analysis of email headers. This can help identify if the DKIM signature is being altered somewhere between Salesforce and the final recipient. This includes checking the Authentication-Results header for clues about the failure.

Email marketer from SuperUser forum suggests checking Gmail's configuration. They suggest that there could be a configuration problem with the way Gmail is set up to handle outgoing emails from Salesforce, especially with regard to how it handles the DKIM signature.

Email marketer from Mailhardener explains that DKIM alignment issues can cause failures. Checking if the 'd=' tag in the DKIM signature matches the domain used in the 'From:' header.

Email marketer from Reddit explains that character encoding problems can lead to DKIM failures. If Salesforce and Gmail use different character encodings, the email body may be altered during transmission, causing the DKIM signature to be invalid.

Expert from Email Geeks suggests that the DKIM signature failing is likely due to Google modifying the body after Salesforce signs it. The expert suggests sending a very plain email as a test and opening a ticket with Salesforce.

Expert from Spam Resource explains that when sending from Salesforce via Gmail, a DKIM failure often stems from Gmail modifying the email's content after Salesforce has signed it. This alteration, even if minor, invalidates the DKIM signature because the cryptographic hash no longer matches the email body. Potential solutions are ensuring the message is transmitted in a way that preserves the integrity of the content or adjusting the DKIM configuration to accommodate Gmail's handling.

Expert from Email Geeks recommends disabling Salesforce DKIM signing and letting Google Workspace sign instead. The expert also suggests testing with generic content to rule out encoding problems as a cause of the DKIM failure.

Expert from Word to the Wise shares that character encoding can play a significant role in DKIM failures. If Salesforce is using one encoding and Gmail another, special characters may be misinterpreted, leading to slight alterations in the email body. A best practice to resolve this is to ensure that consistent character encoding (e.g., UTF-8) is used throughout the entire sending process, and also to conduct testing with very simple emails consisting of plain ASCII text to determine if the issue lies specifically with character encoding differences.

Documentation from DKIM.org mentions that common DKIM errors are often due to issues with the body hash not verifying. This indicates that the message body has changed since the signature was generated.

Documentation from Salesforce Help explains that a common cause of DKIM failure is modification of the email content after it has been signed. This can occur if Gmail alters the message body during transmission, causing the DKIM hash to no longer match the content.

Documentation from Google Developers highlights that the Gmail SMTP relay service can sometimes modify email headers and body. The Google SMTP service could be altering the message in such a way that it invalidates the DKIM signature generated by Salesforce.

Documentation from Google Workspace Admin Guide emphasizes the importance of proper DKIM setup. A potential reason for DKIM failure is incorrect DNS records for DKIM. Ensuring the DNS records are correctly published and propagated is crucial.

Documentation from RFC Editor, specifies that DKIM relies on the email content remaining unchanged between signing and verification. Any modifications to the body or headers will cause DKIM verification to fail.