DIAGNOSTIC PLAYBOOK
DKIM key exists, but messages are not signed
Publishing a DKIM key does not activate signing inside your mail service. If a received message has no DKIM-Signature header, inspect the actual sending route and its signing configuration before changing the public key.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Obtain a fresh message sent through the affected application, not just a personal mailbox on the same domain.
- Look for a DKIM-Signature header and compare the route with the service configured to sign.
- Enable the service's supported signing flow and confirm a new message contains the expected domain and selector.
What this looks like
ILLUSTRATIVE EXAMPLE
Your mailbox signs correctly, but the website form sends directly through a different server. Publishing the mailbox key cannot make the website server sign.
A mistake to avoid
A receiving gateway may alter the available evidence. Compare a direct controlled delivery before concluding that the origin never signed.
Keep the result in context
A DKIM investigation needs a real signed message and the public key for its selector and signing domain. DNS alone cannot prove that a service is signing outgoing mail. Preserve the raw source when comparing messages so your own copy process does not change the bytes being checked.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.