DKIM signature fails (invalid signature or body hash)

What it means

Your email carries a DKIM signature, but when the receiver checks it, it does not match. There are two main kinds of failure:

• Invalid signature or key not found: the public key in your DNS is missing, wrong, or does not belong to the private key used to sign.
• Body hash did not verify: the key is fine, but the content of the email was changed after it was signed. Even one added line breaks the signature.

Why it matters

A failed signature counts as no signature, and sometimes worse: it can look like the email was tampered with. If SPF does not pass for your domain either, DMARC fails and the email may go to spam or be rejected.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page, copy your unique test address, send it a normal email from the mailbox you want to check, then open the report. The DKIM line shows the signing domain and the result, for example "d=yourdomain.com: fail".
• Use the Domain scanner: type your domain at /domain-scanner to read your DNS records without sending anything.

Note the selector used (for example google, selector1, s1). Type it in the Domain scanner to see the key that is published under that name.

How to fix a key problem

1. Check the key exists at selector._domainkey.yourdomain.com. If the scanner finds nothing, the record is missing or has the wrong name.
2. Check the name. Many DNS providers add your domain automatically. Enter selector._domainkey, not the full name, or you get selector._domainkey.yourdomain.com.yourdomain.com.
3. Check the value is complete. Long keys are easily cut, or broken by extra spaces or quotes. Copy the value again from your provider, in one go.
4. Check it is the current key. If you regenerated DKIM in your provider, the old DNS value no longer works. Publish the new one.

A correct DKIM TXT record looks like this:

s1._domainkey.yourdomain.com  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

With Microsoft 365, the records are CNAMEs pointing to Microsoft. Copy them exactly as shown in the Defender portal and do not replace them with TXT records.

How to fix a body hash problem

Something modified your email between the moment it was signed and the moment it arrived. Common causes:

• An antivirus or security gateway that adds a footer such as "Scanned for viruses".
• A server or relay that adds a legal disclaimer after signing.
• A mailing list or group that adds an unsubscribe footer or changes the subject.
• Your own mail server signing first, then relaying through another service that changes the content.

The fix is to make sure signing happens last, after every change. Either move the disclaimer or footer before signing, or turn it off, or let the final sending service do the signing.

Check that it is fixed

DNS changes are not instant. Most are visible within a few minutes, but some providers take up to 24 to 48 hours.

Send a new test email from the home page, from the same mailbox or tool that failed. The report should show DKIM passing for your domain. If only one sending tool fails, the problem is specific to that tool's setup.