--- title: "How to Troubleshoot Invalid DKIM Signatures and Body Hash Failures | AutoSPF" description: "Troubleshoot invalid DKIM signatures and body hash failures by identifying DNS, selector, key, and message modification issues to restore email authentication." image: "https://autospf.com/og/blog/how-to-troubleshoot-invalid-dkim-signatures-and-body-hash-failures.png" canonical: "https://autospf.com/blog/how-to-troubleshoot-invalid-dkim-signatures-and-body-hash-failures/" --- Quick Answer DKIM signature failures are commonly caused by incorrect DNS records, selector or key mismatches, or changes to email content during transit. Check authentication headers, validate DKIM DNS records, verify key pairs, and inspect gateways or relays for message modifications. ## Try Our Free DKIM Lookup Auto-discover DKIM selectors for any domain. [ Discover DKIM Selectors → ](/tools/dkim-lookup/) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-troubleshoot-invalid-dkim-signatures-and-body-hash-failures%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=How%20to%20Troubleshoot%20Invalid%20DKIM%20Signatures%20and%20Body%20Hash%20Failures&url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-troubleshoot-invalid-dkim-signatures-and-body-hash-failures%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-troubleshoot-invalid-dkim-signatures-and-body-hash-failures%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-troubleshoot-invalid-dkim-signatures-and-body-hash-failures%2F&title=How%20to%20Troubleshoot%20Invalid%20DKIM%20Signatures%20and%20Body%20Hash%20Failures "Share on Reddit") [ ](mailto:?subject=How%20to%20Troubleshoot%20Invalid%20DKIM%20Signatures%20and%20Body%20Hash%20Failures&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-troubleshoot-invalid-dkim-signatures-and-body-hash-failures%2F "Share via Email") ![Invalid DKIM Signature Troubleshooting](https://media.mailhop.org/autospf/spf-record-checker-1032-1788180576436.jpg) ## What “DKIM Fail: Signature Did Not Verify” Means A DKIM fail means the receiving [mail server](https://www.activecampaign.com/glossary/mail-server) could not confirm that the DKIM signature attached to a message matches the message content and the sender’s published public key. In DomainKeys Identified Mail, the sending MTA signs selected parts of the email with a [private key](https://www.investopedia.com/terms/p/private-key.asp), and the recipient performs **DKIM validation** by retrieving the matching public key from DNS. When the result says the signature did not verify, it usually means one of two things: the receiving server could not retrieve or use the correct key, or the message changed after it was signed. In logs, you may see errors such as invalid [DKIM signature](https://docs.mapp.com/docs/dkim-signature), “DKIM signature did not verify,” or even SMTP rejection text like 550 DKIM validation failed. ### How DKIM Validation Works During DKIM validation, the receiving server reads the `DKIM-Signature` header, identifies the selector and domain, performs key retrieval from the relevant [DNS TXT record](https://www.cloudflare.com/learning/dns/dns-records/dns-txt-record/), and compares the computed hash with the **values in the signature**. The process depends on several fields: - `d=` identifies the signing domain. - `s=` identifies the selector. - `h=` lists the signed headers. - `bh=` contains the body hash. - `b=` contains the **cryptographic signature**. If the body hash calculated by the receiver does not match the `bh=` value, the message likely suffered message modification after signing. If the signature itself did not verify, the issue may involve a key mismatch, selector mismatch, altered headers, or [DNS errors](https://www.netgear.com/hub/network/fix-dns-error/).![Spf Lookup 3401](https://media.mailhop.org/autospf/spf-lookup-3401-1788181786943.jpg) #### DKIM Fail vs. DMARC Failure A DKIM fail does not always mean a DMARC failure. DMARC evaluates both DKIM and SPF, plus alignment with the From domain. However, if DKIM fails and [SPF](https://autospf.com/blog/what-is-spf-email-a-guide-to-sender-validation-technology/) also fails or does not align, the message may violate the **organization’s dmarc policy**. This is where alignment failure becomes important: even a technically valid DKIM signature may not satisfy DMARC if it does not align with the visible sender identity. ## Common Causes of Invalid DKIM Signatures and Body Hash Mismatches _An invalid DKIM signature is usually caused by DNS problems, signing configuration errors, or changes introduced during the mail flow._ Understanding the failure category helps you avoid chasing the wrong fix. ### DNS, Selector, and Key Problems The most common issue is a selector mismatch. The selector in the `DKIM-Signature` header must match the selector published in DNS. If the sender signs with `s=mail2024`, but DNS only contains `s=default`, the receiver cannot locate the correct [public key](https://www.coursera.org/in/articles/public-key). Other DNS-related causes include: - Missing DKIM record - Malformed DKIM record - Incorrect TXT record formatting - Expired or incomplete [DNS propagation](https://www.ibm.com/think/topics/dns-propagation) - Temporary DNS downtime - Provider-side DNS errors A key mismatch can occur when the private key used by the sender does not correspond to the public key in DNS. #### Public Key and Private Key Pairing _The private key must remain on the signing server or platform, while the public key must be published in DNS._ If the private key changes but the public key is not updated, the DKIM signature did not verify because the **cryptographic pair** no longer matches. - **Key File References in OpenDKIM:** In OpenDKIM, check `KeyTable`, `SigningTable`, and key file references. A stale path, wrong permissions, or incorrect selector can cause a DKIM fail even when the DNS record appears correct. - **Key Expiration and Rotation:** DKIM keys do not inherently expire, but organizations often enforce key expiration policies. During key rotation, keep the old public key available until all signed messages using the old private key have cleared the delivery path. ![Spf Record Checker 3019](https://media.mailhop.org/autospf/spf-record-checker-3019-1788181880264.jpg) ### Message Modification and Header Changes A body hash failure usually indicates message modification. _DKIM signs the canonicalized message body, so even small changes to email content can break the hash._ Common examples include: - Disclaimers appended by **email gateways** - Tracking links added by marketing tools - Footer changes by forwarding services - MIME boundary rewrites - Encoding changes - Antivirus or [DLP](https://en.wikipedia.org/wiki/Data%5Floss%5Fprevention) alterations - Header changes affecting signed headers If the body hash fails, the receiver’s calculated hash does not match the bh= value in the DKIM signature. _This usually means the message body was modified after it was signed, which is why email forwarding, mailing lists, and relays can sometimes cause DKIM verification failures._ ## Step-by-Step Checks: DNS Records, Selectors, and Public Keys Troubleshooting should begin with the message itself. Do not rely only on a dashboard summary from Microsoft Outlook, Microsoft 365, DMARC Analyzer, or another secure email tool. Review the raw message headers and **authentication results**. ### Inspect the Authentication Results Header Look for a header similar to: ``` Authentication-Results: mx.example.net; dkim=fail reason="signature did not verify"; spf=pass; dmarc=fail ``` This tells you whether the issue is a DKIM fail, SPF issue, or [DMARC](https://autospf.com/blog/what-is-dmarc-email-authentication-guide/) policy issue. If the reason says the signature did not verify, focus on the DKIM signature, selector, [DNS lookup](https://www.digicert.com/faq/dns/how-does-dns-lookup-work), and **body hash**. Check whether the receiver reports: - `dkim=fail body hash did not verify` - `dkim=fail signature did not verify` - `dkim=temperror` - `dkim=permerror` - `550 DKIM validation failed` A temporary error often points to DNS errors, [DNS downtime](https://falconcloud.ae/about/blog/what-are-the-common-causes-of-dns-downtime/), or server communication problems. _A permanent error suggests a bad selector, malformed record, or configuration issue_.![Spf Record Example 3308](https://media.mailhop.org/autospf/spf-record-example-3308-1788182291890.jpg) #### Confirm Selector and Domain From the `DKIM-Signature` header, identify the **selector and signing domain**: ``` DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; ``` Query DNS for: ``` selector1._domainkey.example.com ``` If the selector does not exist, you likely have a selector mismatch. If the selector exists but contains the wrong key, it may be a key mismatch. _If the query fails intermittently, investigate DNS errors, authoritative nameserver health, and DNS propagation._ #### Validate the TXT Record Format The **DKIM TXT record** should include a valid `p=` value containing the public key. A malformed [DKIM record](https://autospf.com/blog/dkim-record-lookup-find-and-fix-missing-or-misconfigured-keys/) may include broken quotes, missing semicolons, extra spaces, truncated values, or copied line breaks from a provider portal. ## Investigating Message Changes in Transit That Break DKIM If **DNS and keys** are correct but the body hash still fails, investigate the delivery path. DKIM is sensitive to message modification, especially after the message leaves the original signing [MTA](https://en.wikipedia.org/wiki/Message%5Ftransfer%5Fagent). ### Trace the Delivery Path Review each hop in the Received headers. Look for a relaying server, filtering appliance, archive service, or **security layer** that modifies outbound mail. Common sources include: - Mimecast or other secure gateways - Microsoft 365 transport rules - Marketing automation platforms - Ticketing systems - Forwarding services - Legacy gateways configured through Internet Explorer-era admin portals - Email clients such as Microsoft Outlook, or **workflow systems** connected to Microsoft Teams A gateway may add banners, rewrite URLs, or append legal disclaimers. _That message modification can invalidate the body hash, causing the DKIM signature to fail even if the public key and private key are correct._ ### Email Forwarding and Mailing Lists Email forwarding is a frequent DKIM-breaking scenario. Forwarding services may alter [MIME](https://brightdata.com/glossary/mime) structure, change encoding, or add headers\*.\* Mailing lists may modify subject lines or footers. If these changes affect signed headers or body content, the result may be DKIM fail. #### Canonicalization Matters Relaxed **canonicalization tolerates** minor whitespace and header folding changes, but it does not allow meaningful email content changes. If the original body changes, the body hash will not match, and the message did not verify.![Spf Lookup 1412](https://media.mailhop.org/autospf/spf-lookup-1412-1788183989018.jpg) ## Fixing DKIM Failures and Preventing Future Authentication Issues Resolving a DKIM fail requires matching the fix to the root cause. _Avoid simply regenerating keys unless you know whether the problem is DNS, signing, or message modification._ ### Practical Remediation Checklist Use this sequence when troubleshooting production [outbound mail](https://www.ricoh-usa.com/en/glossary/outbound-mail): - Review authentication results and raw message headers. - Confirm whether the error is body hash, key retrieval, or **signature verification**. - Validate the selector and domain in the `DKIM-Signature`. - Query the DKIM TXT record directly from public DNS. - Check for DNS errors, DNS propagation delays, or DNS downtime. - Compare the public key with the signing system’s private key. - Trace mail flow through gateways, relays, and forwarding services. - Disable or move disclaimers, link rewriting, and content filters before signing. - Re-test DKIM validation with fresh messages. If using OpenDKIM, restart the service after correcting key file references. If using Microsoft 365, confirm DKIM is enabled for the domain and that the CNAME or TXT configuration matches current Microsoft guidance. The **Microsoft Q&A forum** and other Q&A forum resources can help interpret edge cases, but raw headers remain the most reliable source. #### Preventive Best Practices Strong DKIM operations depend on clear ownership and ongoing monitoring. Establish documented best practices for key rotation, [third-party sender](https://www.lawinsider.com/dictionary/third-party-sender) onboarding, DNS change control, and dmarc reporting. #### Operational Controls Maintain an inventory of selectors, DKIM records, vendors, and signing systems. Test changes in a controlled environment, preferably using TLS-secured submission paths and authenticated server communication. For broader [email security](https://autospf.com/), monitor **DKIM, DMARC, and SPF** together rather than treating them as isolated controls. ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-troubleshoot-invalid-dkim-signatures-and-body-hash-failures%2F) [ ](https://twitter.com/intent/tweet?text=How%20to%20Troubleshoot%20Invalid%20DKIM%20Signatures%20and%20Body%20Hash%20Failures&url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-troubleshoot-invalid-dkim-signatures-and-body-hash-failures%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-troubleshoot-invalid-dkim-signatures-and-body-hash-failures%2F) Copy Related Articles - [ ![permanent error](https://media.mailhop.org/autospf/images/2024/07/spf-record-office-365-4110.jpg) What is the ‘554 5.7.5’ permanent error in DMARC and how to fix it? Advanced ](/blog/554-5-7-5-permanent-error-in-dmarc-and-how-to-fix-it/) - [ ![cybersecurity trends](https://media.mailhop.org/autospf/images/2024/09/spf-checker-52320.jpg) 8 cybersecurity trends that will redefine the digital landscape in 2024 Advanced ](/blog/8-cybersecurity-trends-that-will-redefine-the-digital-landscape-in-2024/) - [ ![Advanced SPF Flattening](https://media.mailhop.org/autospf/images/2026/02/kitterman-spf-5221.jpg) Advanced SPF Flattening Implementation for Reliable Email Authentication Advanced ](/blog/advanced-spf-flattening-implementation-for-reliable-email-authentication/) - [ ![Protect Your Domain](https://media.mailhop.org/autospf/images/2026/03/spf-validator-5901.jpg) Advanced SPF Record Testing: Protect Your Domain from Permerror Issues Advanced ](/blog/advanced-spf-record-testing-protect-your-domain-from-permerror-issues/) ## Related Articles [ Advanced 8m What is the ‘554 5.7.5’ permanent error in DMARC and how to fix it? Jul 9, 2024 ](/blog/554-5-7-5-permanent-error-in-dmarc-and-how-to-fix-it/)[ Advanced 6m 8 cybersecurity trends that will redefine the digital landscape in 2024 Sep 20, 2024 ](/blog/8-cybersecurity-trends-that-will-redefine-the-digital-landscape-in-2024/)[ Advanced 11m Advanced SPF Flattening Implementation for Reliable Email Authentication Feb 19, 2026 ](/blog/advanced-spf-flattening-implementation-for-reliable-email-authentication/)[ Advanced 13m Advanced SPF Record Testing: Protect Your Domain from Permerror Issues Mar 3, 2026 ](/blog/advanced-spf-record-testing-protect-your-domain-from-permerror-issues/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"How to Troubleshoot Invalid DKIM Signatures and Body Hash Failures","description":"Troubleshoot invalid DKIM signatures and body hash failures by identifying DNS, selector, key, and message modification issues to restore email authentication.","url":"https://autospf.com/blog/how-to-troubleshoot-invalid-dkim-signatures-and-body-hash-failures/","datePublished":"2026-08-31T00:00:00.000Z","dateModified":"2026-08-31T00:00:00.000Z","dateCreated":"2026-08-31T00:00:00.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/how-to-troubleshoot-invalid-dkim-signatures-and-body-hash-failures/"},"articleSection":"advanced","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/spf-record-checker-1032-1788180576436.jpg","caption":"Invalid DKIM Signature Troubleshooting"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Advanced","item":"https://autospf.com/advanced/"},{"@type":"ListItem","position":4,"name":"How to Troubleshoot Invalid DKIM Signatures and Body Hash Failures","item":"https://autospf.com/blog/how-to-troubleshoot-invalid-dkim-signatures-and-body-hash-failures/"}]} ```