13 FOCUSED PLAYBOOKS
DKIM diagnostics
Investigate signing keys, selectors and the difference between a published key and a valid message signature.
A DKIM investigation needs a real signed message and the public key for its selector and signing domain. DNS alone cannot prove that a service is signing outgoing mail. Preserve the raw source when comparing messages so your own copy process does not change the bytes being checked.
Run the DKIM checker →DKIM key exists, but messages are not signed
Publishing a DKIM key does not activate signing inside your mail service.
Read the playbook →DIAGNOSTIC PLAYBOOKDKIM selector returns NXDOMAIN
A selector lookup returning NXDOMAIN means the exact queried DNS name does not exist at that resolver.
Read the playbook →DIAGNOSTIC PLAYBOOKDKIM CNAME exists but its target is missing
A DKIM CNAME is only a pointer to the public key.
Read the playbook →DIAGNOSTIC PLAYBOOKDKIM public key does not match the signer
A mismatched public and private key can make DKIM verification fail even when DNS is valid and a signature is present.
Read the playbook →DIAGNOSTIC PLAYBOOKDKIM key revoked: an empty p value
An empty p value in a DKIM key record indicates revocation.
Read the playbook →DIAGNOSTIC PLAYBOOKDKIM signature expired: inspect x and the delivery timeline
A DKIM signature can include an expiration time in its x tag.
Read the playbook →DIAGNOSTIC PLAYBOOKDKIM passes but the subject is not signed
A DKIM pass only protects the fields covered by that signature and its signed body scope.
Read the playbook →DIAGNOSTIC PLAYBOOKDKIM l tag: when only part of the body is signed
The DKIM l tag limits the body bytes covered by a signature after canonicalization.
Read the playbook →DIAGNOSTIC PLAYBOOKDKIM canonicalization: which whitespace changes survive?
DKIM canonicalization defines how headers and body content are normalized before hashing.
Read the playbook →DIAGNOSTIC PLAYBOOKTwo DKIM signatures: one passes and one fails
A message can carry multiple DKIM signatures with different domains, selectors and results.
Read the playbook →DIAGNOSTIC PLAYBOOKRotate DKIM keys without breaking queued mail
A DKIM rotation needs to account for messages signed with the old key but verified later.
Read the playbook →DIAGNOSTIC PLAYBOOKDKIM fails intermittently across sending nodes
Intermittent DKIM failures can reflect different signer configurations behind the same mail service.
Read the playbook →DIAGNOSTIC PLAYBOOKA DKIM key is too weak: plan a supported replacement
A published DKIM key can be syntactically valid yet fail modern cryptographic requirements.
Read the playbook →