DIAGNOSTIC PLAYBOOK
DKIM passes but the subject is not signed
A DKIM pass only protects the fields covered by that signature and its signed body scope. The h tag lists signed header names, so a pass is not a promise that every displayed field is protected.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Read the h list in the signature that passed, preserving repeated header names.
- Confirm the fields your application relies on are covered by the signing configuration.
- For your own signer, review header selection and test legitimate downstream transformations before changing it.
What this looks like
ILLUSTRATIVE EXAMPLE
A signature covers From, Date and Message-ID but omits Subject. A verifier can report pass without authenticating the subject text.
A mistake to avoid
Do not infer that an unsigned field was changed. Missing coverage establishes a protection gap, not evidence of a specific modification.
Keep the result in context
A DKIM investigation needs a real signed message and the public key for its selector and signing domain. DNS alone cannot prove that a service is signing outgoing mail. Preserve the raw source when comparing messages so your own copy process does not change the bytes being checked.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.