In this guide · 8 sections
- 01How to find out why DKIM is failing
- 02Common DKIM failure causes and fixes
- 03Fixing DKIM in Google Workspace
- 04Fixing DKIM in Microsoft 365
- 05Long 2048-bit keys, forwarding and third-party senders
- 06After fixing DKIM: check DMARC before enforcing
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Open a failing message's headers and read the DKIM result. 'No key' means the DNS record is missing or under the wrong selector. 'Body hash did not verify' means the message was changed after signing, often by forwarding or a list. If nothing is signed, turn signing on in Google Workspace or Microsoft 365.
How to find out why DKIM is failing
Send a message from the affected account to a Gmail or Outlook mailbox, open it, and view the original message or headers. Look for the Authentication-Results line and the DKIM-Signature header.
Find the DKIM result
Authentication-Results shows dkim=pass, fail, neutral, none or permerror, often with a short reason.
Check which domain signed
In DKIM-Signature, d= is the signing domain. If it is your email provider's domain rather than yours, DKIM may pass but not align for DMARC.
Note the selector
s= is the selector. The public key must be published at selector._domainkey.yourdomain.
Look up that DNS record
Query the TXT (or CNAME) record at that exact name. If nothing comes back, the key is missing or misnamed.
Compare with a direct message
If mail sent directly passes but mail through a list or forwarder fails, the message is being changed in transit.
Common DKIM failure causes and fixes
The result wording varies by receiver, but these are the patterns to look for.
| What you see | Likely cause | Fix |
|---|---|---|
| dkim=none, no DKIM-Signature header | Signing not enabled for your domain | Turn on DKIM in your email admin console |
| No key for signature / key not found | Record missing, wrong host name, or wrong selector | Publish the record at selector._domainkey exactly as given |
| Key syntax error or permerror | Long key pasted with quotes, spaces or line breaks | Re-enter the key; let the DNS panel split long strings correctly |
| Body hash did not verify | Message changed after signing (footer, list, forwarder, security gateway) | Find what modifies mail; adjust that system or rely on aligned SPF |
| Signature verification failed | Key in DNS does not match the signing key (rotated or regenerated) | Copy the current key from the admin console again |
| dkim=pass but DMARC fails | Signed with the provider's domain, not yours (d= mismatch) | Set up custom-domain DKIM for that sender |
Fixing DKIM in Google Workspace
Google Workspace does not sign with your domain until you generate a key, publish it and turn authentication on.
- In the Admin console, go to Apps, Google Workspace, Gmail, Authenticate email, and choose the domain.
- Generate a new record. Pick 2048-bit if your DNS host supports it; Google offers 1024-bit only for hosts that cannot handle longer keys.
- The default prefix selector is google, so the DNS host name is google._domainkey. If another service already uses that selector, choose a different one.
- Publish the TXT value exactly, then return to the console and click Start authentication. Skipping this step is a very common reason DKIM stays off.
If the console keeps saying it is not authenticating, check the record from outside with a DNS lookup. Many DNS panels add the domain automatically, so entering google._domainkey.yourdomain.sg can create google._domainkey.yourdomain.sg.yourdomain.sg.
Fixing DKIM in Microsoft 365
Microsoft 365 handles keys differently. According to Microsoft's DKIM configuration guide, mail from the initial onmicrosoft.com domain is signed automatically, but each custom domain needs two CNAME records, not TXT records: selector1._domainkey and selector2._domainkey, pointing to values Microsoft generates for your tenant.
- Get the exact CNAME targets from the Defender portal (Email authentication settings, DKIM) or with the PowerShell command Get-DkimSigningConfig shown in Microsoft's guide. Do not guess them; the format includes tenant-specific parts.
- Create both CNAMEs at your DNS host, wait for them to resolve, then enable DKIM signing for the domain in the Defender portal.
- Microsoft uses two selectors so it can rotate keys. Both records must stay in place permanently.
If enabling fails with a message that the CNAME records do not exist, check the host names first; the same doubled-domain problem applies.
Long 2048-bit keys, forwarding and third-party senders
Three trickier causes are worth understanding before you start deleting records.
- Long keys and split strings. A single DNS TXT string holds at most 255 characters, so a 2048-bit key is stored as several strings. RFC 6376 says these strings must be joined with no spaces before use. Most DNS panels do this automatically if you paste the whole key; problems start when people paste it with extra quotes, spaces or line breaks. RFC 6376 also says there must be only one TXT record per selector.
- Forwarding and mailing lists. DKIM signs the body and selected headers. A mailing list that adds a footer or tags the subject, or a security gateway that rewrites links, breaks the signature ('body hash did not verify'). Fix the system that alters mail if it is yours; if it is the recipient's, the original signature failing at the final hop is expected.
- Third-party senders. Newsletter tools, helpdesks, booking systems and invoicing apps often sign with their own domain by default. That can pass DKIM but fail DMARC alignment. Look for their 'authenticate your domain' or 'custom DKIM' setting, which usually gives you CNAME or TXT records to publish.
Because DMARC passes if either DKIM or SPF passes and aligns, check SPF at the same time. If SPF is failing with too many lookups, see our SPF lookup limit fix.
After fixing DKIM: check DMARC before enforcing
A working DKIM setup is what makes a strict DMARC policy safe. Before moving from monitoring to quarantine or reject, confirm every legitimate sender passes.
Before tightening DMARC
Our DMARC none, quarantine and reject guide explains the move to enforcement, and emails going to spam: SPF, DKIM and DMARC covers the full set of records.
Do it yourself or get help?
For a single Google Workspace or Microsoft 365 domain, fixing DKIM is usually a 20-minute job once you read the header and find the cause. It gets harder with several sending services, a security gateway in the path, or a DNS host that mangles long keys.
IT Sorted's Emails Land in Spam fix (S$249) inventories every service sending as your domain, sets up SPF, DKIM and DMARC correctly, checks blacklists, and monitors DMARC reports for 14 days before moving to enforcement, with a before and after test report.
Frequently asked questions
The most common causes are that signing was never switched on, the public key was published under the wrong DNS name or selector, a long key was pasted incorrectly, or the message was changed after signing by a forwarder, mailing list or security gateway. The DKIM result in the message headers tells you which.
It means the message body was changed after it was signed, so the signature no longer matches. Common causes are mailing lists adding footers, forwarders, or security gateways rewriting links. It is not a DNS problem, so changing your DKIM record will not fix it.
Once the DNS record is published, it usually works as soon as the record is visible, but Google says it can take up to 48 hours for DKIM authentication to start in Google Workspace. A brand new Workspace organisation may also need to wait 24 to 72 hours before it can generate a key.
Use 2048-bit if your DNS host supports it, as Google recommends. Choose 1024-bit only if the host cannot store long TXT values. A 2048-bit key is stored as several strings joined together, so paste it exactly as given without extra quotes or spaces.
DKIM can pass using the sending service's own domain rather than yours. DMARC needs the DKIM signing domain to align with your From domain, or SPF to pass and align. Set up custom-domain DKIM for that service so it signs as your domain.