By Nilesh Maini, founder of EmailQo. Updated November 2026.
Quick answer: DKIM fails when the receiving server cannot verify the signature in your email's DKIM-Signature header. The usual causes are a missing or mistyped public key in DNS, a selector mismatch, a key that was rotated without updating DNS, or the message being changed after signing (by a forwarder, a mailing list, or a security gateway). Read the s= and d= tags from a real message header, look up that exact record, and compare.
How DKIM works in one paragraph
When your provider sends an email, it signs selected headers and the body with a private key and adds a DKIM-Signature header. That header names a domain (d=) and a selector (s=). The receiver fetches the public key from DNS at selector._domainkey.domain and checks the signature. If the key is missing, wrong, or the signed content changed in transit, DKIM fails (RFC 6376).
Step 1: find the exact record the receiver looked up
Open a real message you sent (in Gmail: Show original on desktop) and find the signature:
DKIM-Signature: v=1; a=rsa-sha256; d=yourdomain.com; s=s1;
c=relaxed/relaxed; h=from:to:subject:date; bh=...; b=...
Then look up that selector:
dig +short TXT s1._domainkey.yourdomain.com
Many providers publish DKIM as a CNAME that points to their own record:
dig +short CNAME s1._domainkey.yourdomain.com
Check the result line in Authentication-Results too. It often tells you the reason, for example dkim=fail (bad signature) or dkim=temperror (no key for signature).
The 8 most common causes of DKIM failure
1. The DNS record is missing
Result: no key for signature or permerror.
Fix: publish the record your provider gives you, at exactly selector._domainkey.yourdomain.com. Watch for DNS panels that append your domain automatically, which creates s1._domainkey.yourdomain.com.yourdomain.com. Enter only s1._domainkey in those panels.
2. Selector mismatch
Result: no key found, even though you published "a DKIM record".
Fix: the selector in DNS must match the s= tag the provider signs with. Google Workspace commonly uses google, Microsoft 365 uses selector1 and selector2, and other platforms set their own. Copy the selector from the header, not from memory.
3. A broken or truncated public key
Result: bad signature or invalid public key.
Why: 2048 bit keys are longer than 255 characters, the maximum length of a single DNS TXT string. Some DNS panels cut the key off, or add spaces or line breaks when you paste.
Fix: paste the key exactly, with no extra quotes or spaces. If your panel requires it, split the value into multiple quoted strings of 255 characters or less; DNS joins them back together. Then compare the p= value from dig with the one your provider shows.
4. The key was rotated but DNS was not updated
Result: signing works for a while, then fails everywhere.
Fix: when you regenerate a DKIM key in your email admin, publish the new public key before you switch signing on. Keep the old selector record until mail signed with it has been delivered.
5. You turned on DKIM in DNS but not in the email admin
Result: messages have no DKIM signature from your domain at all, only the provider's default.
Fix: in Google Workspace, DKIM signing has to be started in the Admin console after the DNS record is published. In Microsoft 365, DKIM signing has to be enabled for the custom domain. Publishing DNS alone does nothing.
6. The message was changed after signing
Result: body hash did not verify.
Why: anything that edits the signed headers or body breaks the signature: a mailing list adding a footer, a security gateway rewriting links, a forwarding service changing the subject.
Fix: for your own sending, avoid tools that modify mail after the provider signs it. For forwarding and lists, you cannot fully control this, which is why DMARC needs only one of SPF or DKIM to pass.
7. DNS has not propagated yet
Result: works for some receivers, not others, right after a change.
Fix: wait for the TTL to expire (often minutes to a few hours), then test again. Check from more than one resolver:
dig +short TXT s1._domainkey.yourdomain.com @8.8.8.8
dig +short TXT s1._domainkey.yourdomain.com @1.1.1.1
8. DKIM passes, but for the wrong domain
Result: dkim=pass header.i=@provider.com while DMARC fails.
Why: the message is signed with your provider's domain, not yours. This is not a DKIM failure, but it causes DMARC failure because DKIM does not align with your From domain.
Fix: set up custom DKIM for your domain in your provider's dashboard so the signature uses d=yourdomain.com.
Diagnosis table
| What you see | Most likely cause |
|---|
no key for signature | Missing record or selector mismatch (causes 1, 2) |
bad signature / invalid public key | Truncated or mangled key (cause 3) |
body hash did not verify | Message modified after signing (cause 6) |
| Fails right after a change | Propagation (cause 7) or rotation order (cause 4) |
dkim=pass but dmarc=fail | Signed with provider's domain (cause 8) |
| No DKIM signature from your domain | Signing not enabled in the email admin (cause 5) |
Why DKIM matters more now
Gmail and Yahoo require bulk senders to authenticate with SPF and DKIM and to publish DMARC (Google sender guidelines). For cold email, DKIM matters most: it is the authentication method that survives forwarding, and it is usually the easiest way to get DMARC alignment. For how SPF, DKIM, DMARC, BIMI and ARC fit together, see this email authentication guide.
A quick way to confirm the result: use a free DKIM checker with your domain and selector to see whether the public key is published and readable.
FAQ
Why does DKIM fail?
Usually because the public key in DNS is missing, mistyped or for a different selector, or because the message was changed after it was signed.
How do I find my DKIM selector?
Open a message you sent, view the original headers, and read the s= tag in the DKIM-Signature header.
What does "body hash did not verify" mean?
The message body changed after it was signed, often because a mailing list, forwarder or security gateway added or rewrote content.
Should I use a 1024 bit or 2048 bit DKIM key?
2048 bit where your provider and DNS host support it. It is the current recommended size.
Can DKIM pass while DMARC fails?
Yes, when the message is signed with a domain other than the one in your From address. DMARC requires the DKIM domain to align with the From domain.