DIAGNOSTIC PLAYBOOK
TLS passes but DKIM fails: separate the security layers
TLS and DKIM protect different parts of email delivery. An encrypted connection can carry a message whose signature is invalid, and a valid signature does not show that every transport hop was encrypted.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Record the TLS evidence for the relevant connection and the DKIM result for the actual message.
- Investigate certificate or connection issues separately from signature lookup and content changes.
- Retest each layer using the appropriate endpoint check or raw-message verification.
What this looks like
ILLUSTRATIVE EXAMPLE
A gateway receives mail over TLS, inserts a footer and relays it onward. The encrypted hop succeeds while the original body signature may no longer verify.
A mistake to avoid
A single Received header cannot prove end-to-end encryption. Avoid presenting one successful hop as complete protection for the message's entire journey.
Keep the result in context
Transport encryption protects a connection between mail systems. It is different from message authentication and does not imply end-to-end encryption. Investigate the receiving MX hostname, the TLS session and the applicable policy separately before deciding which system needs a change.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.