DIAGNOSTIC PLAYBOOK
A mail gateway footer changes the signed message
A disclaimer or security footer inserted after DKIM signing can invalidate the original body signature. The order of transformation and signing matters as much as the published key.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Compare a copy immediately after signing with the final received raw message.
- Locate any footer, HTML rewrite or MIME transformation introduced by the gateway.
- Where supported, perform modifications before the final authorized signing step and test all message formats.
What this looks like
ILLUSTRATIVE EXAMPLE
Plain-text mail passes, but HTML mail gets a branded footer after signing and fails body verification. The problem is tied to a transformation path.
A mistake to avoid
Re-signing under a gateway's unrelated domain may not provide DMARC alignment for the original From domain.
Keep the result in context
Inspect the original raw message rather than a forwarded screenshot. Headers can contain private addresses, message identifiers and routing information, so redact a separate copy before sharing. Give the most weight to results added by your own trusted receiving infrastructure.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.