DIAGNOSTIC PLAYBOOK
DKIM public key does not match the signer
A mismatched public and private key can make DKIM verification fail even when DNS is valid and a signature is present. This commonly follows a partial key rotation or configuration drift between signing nodes.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Confirm the message's selector and signing domain, then retrieve the matching public key.
- On systems you administer, compare the loaded key's public component with DNS without exporting the private key.
- Align the signer and published key, and send fresh samples from every active sending node.
What this looks like
ILLUSTRATIVE EXAMPLE
One server loads a new private key while another still uses the old key under the same selector. Results vary with the server that handles the message.
A mistake to avoid
A generic DKIM fail does not uniquely identify a key mismatch. Rule out message mutation and lookup errors before replacing keys.
Keep the result in context
A DKIM investigation needs a real signed message and the public key for its selector and signing domain. DNS alone cannot prove that a service is signing outgoing mail. Preserve the raw source when comparing messages so your own copy process does not change the bytes being checked.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.