DIAGNOSTIC PLAYBOOK
DKIM fails intermittently across sending nodes
Intermittent DKIM failures can reflect different signer configurations behind the same mail service. Group messages by node, selector and route before treating random-looking results as a DNS problem.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Collect several passing and failing samples with send times and provider message identifiers.
- Compare selectors, signing domains and trusted routing headers across the groups.
- Ask the mail operator to check key deployment, signing activation and message transformations on the divergent path.
What this looks like
ILLUSTRATIVE EXAMPLE
Most messages use a new selector, but a backup node signs with a removed selector during load spikes. The error appears intermittent to recipients.
A mistake to avoid
Samples from different campaigns may also differ in content transformations. Correlation with a node is a lead to verify, not a complete root cause.
Keep the result in context
A DKIM investigation needs a real signed message and the public key for its selector and signing domain. DNS alone cannot prove that a service is signing outgoing mail. Preserve the raw source when comparing messages so your own copy process does not change the bytes being checked.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.