Why is Outlook breaking DKIM keys and how can I fix it?
Summary
What email marketers say12Marketer opinions
Email marketer from EmailSecuritySPF notes that email forwarders, including those used by Outlook, often modify the email headers, leading to DKIM failures. Recommends using SRS (Sender Rewriting Scheme) to rewrite the sender address, preserving DKIM and SPF validation.
Marketer from Email Geeks refers to this article about DKIM breaking when forwarding email: <https://techcommunity.microsoft.com/t5/networking-principles/microsoft-s-e-mailservers-break-dkim-on-non-ascii-characters/td-p/1774384>
Email marketer from Reddit explains that DMARC failures in forwarded emails often occur because the forwarding process alters the email headers, invalidating the DKIM signature. Suggests that the receiving domain should implement SRS to correct the sender information.
Email marketer from SMTP2GO suggests double-checking your SPF and DKIM records are correct, as well as checking that your message isn't being modified in transit and the encoding is correct. They also suggest using an email validation tool to test.
Marketer from Email Geeks reports that they are seeing Outlook breaking every piece of DKIM Signature from Postmark across multiple clients, indicating a global issue.
Email marketer from Stack Overflow suggests that Outlook's DKIM issues might be related to the email's charset. Specifically, it recommends ensuring that the email is encoded using UTF-8 to avoid problems with character encoding that could invalidate the DKIM signature.
Email marketer from AuthSMTP says you should check that SPF and DKIM are setup correctly, use the correct DNS records, and always use UTF-8 encoding. They also suggest keeping your email lists clean to avoid spam filters.
Email marketer from Super User mentions that DKIM signatures can break when emails contain non-ASCII characters. This is due to encoding issues when the email is processed by different email systems. Converting to UTF-8 might help.
Email marketer from Word to the Wise explains that DKIM canonicalization issues with Microsoft can happen when Microsoft modifies the email content, causing the DKIM signature to fail. The article highlights that different systems have different interpretations of the DKIM RFC, leading to canonicalization problems.
Email marketer from Mailhardener explains that implementing SRS (Sender Rewriting Scheme) is crucial for handling email forwarding in a way that preserves DKIM and SPF authentication. SRS rewrites the sender address, ensuring that the forwarded email can still be authenticated.
Email marketer from Microsoft Archive discusses the forwarding email problem in Office 365, noting that changes made during forwarding can cause DKIM failures. Advises administrators to understand how forwarding rules affect email authentication.
Marketer from Email Geeks shares that DKIM will fail if an email is modified, as the receiving server cannot re-sign it to match the original encrypted signature. Believes Outlook is looking for UTF-8 encoding.
What the experts say3Expert opinions
Expert from Word to the Wise explains that DKIM canonicalization issues can arise with Microsoft because they sometimes modify email content in transit. This modification invalidates the DKIM signature, as the hash of the message no longer matches the original. The article highlights how different systems have differing interpretations of the DKIM RFC, leading to canonicalization problems.
Expert from Email Geeks states they are running into an issue where Outlook is breaking DKIM keys for some customers. They suspect Outlook is modifying the emails prior to DKIM validation, causing the failure and refers to this article: <https://wordtothewise.com/2016/12/dkim-canonicalization-or-why-microsoft-breaks-your-mail/>
Expert from Email Geeks shares they've seen similar issues recently. Suggests looking for out-of-spec characters in an encoding that Microsoft might be changing, or even tabs being converted to spaces.
What the documentation says5Technical articles
Documentation from RFC Editor, the official DKIM standard (RFC 6376), states that DKIM signatures are designed to be invalidated when the message body or headers are altered in transit. Any modification, including those by email clients like Outlook, can cause DKIM verification to fail.
Documentation from Microsoft Docs explains that forwarding emails in Outlook can break DKIM due to modifications during the forwarding process. It recommends configuring SPF and DKIM correctly and educating users about the implications of forwarding.
Documentation from DMARC.org explains the importance of setting up email authentication (SPF, DKIM and DMARC), and explains how they work. Using these settings correctly will tell an email provider your email is valid.
Documentation from dkimproxy explains that modifications to email headers, including adding or removing fields, can invalidate DKIM signatures. Advises using tools like dkimproxy to re-sign emails after they've been altered.
Documentation from Microsoft Support details that Outlook might change the message format during sending or forwarding, affecting the DKIM signature. Recommends ensuring the sending server uses a consistent message format and character encoding.