DIAGNOSTIC PLAYBOOK
Two DKIM signatures: one passes and one fails
A message can carry multiple DKIM signatures with different domains, selectors and results. Evaluate each signature separately and identify which passing identity, if any, aligns with the visible From domain.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- List every signature's d and s values alongside the receiver's result.
- Match the passing signature to its actual signing domain rather than treating any pass as your domain's pass.
- Investigate the failed signature's owner while checking whether another valid aligned signature satisfies DMARC.
What this looks like
ILLUSTRATIVE EXAMPLE
A platform signature passes under the vendor domain, but the customer's custom-domain signature fails. The vendor pass alone may not align with the customer's From address.
A mistake to avoid
Multiple signatures are not inherently suspicious. Relays and platforms may add their own signatures as mail moves between systems.
Keep the result in context
A DKIM investigation needs a real signed message and the public key for its selector and signing domain. DNS alone cannot prove that a service is signing outgoing mail. Preserve the raw source when comparing messages so your own copy process does not change the bytes being checked.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.