13 FOCUSED PLAYBOOKS

DKIM diagnostics

Investigate signing keys, selectors and the difference between a published key and a valid message signature.

A DKIM investigation needs a real signed message and the public key for its selector and signing domain. DNS alone cannot prove that a service is signing outgoing mail. Preserve the raw source when comparing messages so your own copy process does not change the bytes being checked.

Run the DKIM checker
DIAGNOSTIC PLAYBOOK

DKIM key exists, but messages are not signed

Publishing a DKIM key does not activate signing inside your mail service.

Read the playbook →
DIAGNOSTIC PLAYBOOK

DKIM selector returns NXDOMAIN

A selector lookup returning NXDOMAIN means the exact queried DNS name does not exist at that resolver.

Read the playbook →
DIAGNOSTIC PLAYBOOK

DKIM CNAME exists but its target is missing

A DKIM CNAME is only a pointer to the public key.

Read the playbook →
DIAGNOSTIC PLAYBOOK

DKIM public key does not match the signer

A mismatched public and private key can make DKIM verification fail even when DNS is valid and a signature is present.

Read the playbook →
DIAGNOSTIC PLAYBOOK

DKIM key revoked: an empty p value

An empty p value in a DKIM key record indicates revocation.

Read the playbook →
DIAGNOSTIC PLAYBOOK

DKIM signature expired: inspect x and the delivery timeline

A DKIM signature can include an expiration time in its x tag.

Read the playbook →
DIAGNOSTIC PLAYBOOK

DKIM passes but the subject is not signed

A DKIM pass only protects the fields covered by that signature and its signed body scope.

Read the playbook →
DIAGNOSTIC PLAYBOOK

DKIM l tag: when only part of the body is signed

The DKIM l tag limits the body bytes covered by a signature after canonicalization.

Read the playbook →
DIAGNOSTIC PLAYBOOK

DKIM canonicalization: which whitespace changes survive?

DKIM canonicalization defines how headers and body content are normalized before hashing.

Read the playbook →
DIAGNOSTIC PLAYBOOK

Two DKIM signatures: one passes and one fails

A message can carry multiple DKIM signatures with different domains, selectors and results.

Read the playbook →
DIAGNOSTIC PLAYBOOK

Rotate DKIM keys without breaking queued mail

A DKIM rotation needs to account for messages signed with the old key but verified later.

Read the playbook →
DIAGNOSTIC PLAYBOOK

DKIM fails intermittently across sending nodes

Intermittent DKIM failures can reflect different signer configurations behind the same mail service.

Read the playbook →
DIAGNOSTIC PLAYBOOK

A DKIM key is too weak: plan a supported replacement

A published DKIM key can be syntactically valid yet fail modern cryptographic requirements.

Read the playbook →