DIAGNOSTIC PLAYBOOK
DKIM l tag: when only part of the body is signed
The DKIM l tag limits the body bytes covered by a signature after canonicalization. A passing signature with this tag may leave appended content outside the protected portion.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Inspect the l value and determine why the signer uses partial-body coverage.
- Compare the received body length and transformation path with the signed scope.
- Where you control signing, assess removing partial coverage and retest mailing lists or gateways that modify messages.
What this looks like
ILLUSTRATIVE EXAMPLE
A signer protects the first portion of a message, and a later system appends text. Verification can succeed while the added text was never covered.
A mistake to avoid
Do not treat l as a fix for arbitrary DKIM failures. Reducing signed coverage changes the security properties of the message.
Keep the result in context
A DKIM investigation needs a real signed message and the public key for its selector and signing domain. DNS alone cannot prove that a service is signing outgoing mail. Preserve the raw source when comparing messages so your own copy process does not change the bytes being checked.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.