DIAGNOSTIC PLAYBOOK
DKIM signature expired: inspect x and the delivery timeline
A DKIM signature can include an expiration time in its x tag. Delayed delivery or replay of an old message can cause verification trouble even when the public key remains published.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Read the signature's t and x timestamps and compare them with trusted receipt times.
- Check the sender's clock and queue history to distinguish old messages from incorrect timestamps.
- Adjust the signing configuration if appropriate, then test a newly generated message through the same path.
What this looks like
ILLUSTRATIVE EXAMPLE
A message waits in a queue beyond the signer's configured lifetime. Rechecking DNS does not make the original expired signature current.
A mistake to avoid
Do not edit the timestamp inside a signed message; that invalidates the signature. Diagnose with the original and verify fixes using a new send.
Keep the result in context
A DKIM investigation needs a real signed message and the public key for its selector and signing domain. DNS alone cannot prove that a service is signing outgoing mail. Preserve the raw source when comparing messages so your own copy process does not change the bytes being checked.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.