DIAGNOSTIC PLAYBOOK

A mail gateway footer changes the signed message

A disclaimer or security footer inserted after DKIM signing can invalidate the original body signature. The order of transformation and signing matters as much as the published key.

HealthCheck Email editorial team · · Examples are illustrative

How to investigate

  1. Compare a copy immediately after signing with the final received raw message.
  2. Locate any footer, HTML rewrite or MIME transformation introduced by the gateway.
  3. Where supported, perform modifications before the final authorized signing step and test all message formats.

What this looks like

ILLUSTRATIVE EXAMPLE

Plain-text mail passes, but HTML mail gets a branded footer after signing and fails body verification. The problem is tied to a transformation path.

A mistake to avoid

Re-signing under a gateway's unrelated domain may not provide DMARC alignment for the original From domain.

Keep the result in context

Inspect the original raw message rather than a forwarded screenshot. Headers can contain private addresses, message identifiers and routing information, so redact a separate copy before sharing. Give the most weight to results added by your own trusted receiving infrastructure.

Take the next step

Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.

Sources and further reading

The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.