DKIM Authentication Failures

What does DKIM Fail Mean?

DKIM failure refers to the failed status of your DKIM authentication check, due to a mismatch in the domains specified in the DKIM signature header and From header and inconsistencies among the key pair values.

Scenarios where DKIM can fail

1. Error in DKIM record syntax

If you don’t use a reliable DKIM record generator tool to generate your record by trying to manually set it up for your domain, you may implement it wrongly. Syntactical errors in your DNS records can lead to authentication failure, and in this case, DKIM fails. 

2. DKIM identifier alignment failure

If you have DMARC set up for your domain in addition to DKIM, during DKIM verification the domain value in the d= field on the DKIM signature in the email header has to align with the domain found in the from address. It can either be a strict alignment, wherein the two domains have to be an exact match or a relaxed alignment that allows an organizational match to pass the check. 

A DKIM failure can occur if the DKIM signature header domain doesn’t match the domain found in the From header, which might be a typical case of domain spoofing or impersonation attack. 

3. You have not set up DKIM for your third-party email vendors

If you use several third-party email vendors to send emails on behalf of your organization, you need to get in touch with them for instructions on how to activate DKIM for your outbound emails. If you are using your own custom domains or subdomains registered on this third-party service to send emails to your customers, be sure to request your vendor to handle DKIM for you.

Ideally, if your third-party vendor is helping you outsource your emails, they would set your domain up by publishing a DKIM record on their DNS using a DKIM selector that is unique to you, without you having to intrude.

OR, 

You can generate a DKIM key pair and hand over the private key to your email vendor while publishing the public key on your own DNS. 

Misconfigurations in the same can lead to DKIM failure, so it is imperative that you communicate openly with your service provider regarding your DKIM setup. 

Note: Some third-party exchange servers induce formatted footers in the message body. If these servers are intermediary servers in an email forwarding process, the conjoined footer can be a contributing factor to DKIM failure. 

4. Problems in server communication

In certain situations, the email might be sent from a server that has DKIM disabled on it. In such cases, DKIM will fail for that email. It is important to ensure that communicating parties have DKIM properly activated. 

5. Modifications in message body by Mail Transfer Agents (MTAs)

Unlike SPF, DKIM doesn’t verify the sender’s IP address or return path while verifying the authenticity of messages. Instead, it ensures that the message content has remained untampered in transit. Sometimes participating MTAs, and email forwarding agents may alter the message body during line wrapping or content formatting which may lead to DKIM failure. 

Formatting an email’s content is usually an automated process to ensure the message is easily comprehensible for each recipient. 

6. DNS outage / DNS downtime

This is a common reason for authentication failures including DKIM fail. DNS outages may occur due to a variety of reasons including denial of service attacks. Routine maintenance of your name server may also be the reason behind a DNS downtime. During this (usually short) period of time, recipient servers cannot perform DNS queries. 

As we know that DKIM exists in your DNS as a TXT/CNAME record, and the client-server performs a lookup to query the sender’s DNS for the public key during authentication. During an outage, this is deemed not possible and hence may break DKIM. 

7. Using OpenDKIM

An open-source DKIM implementation known as OpenDKIM is commonly used by mailbox providers like Gmail, Outlook, Yahoo, etc. OpenDKIM connects with the server through port 8891 during verification. Sometimes, errors can be caused by enabling wrong permissions due to which your server is unable to bind to your socket. 

Check your directory to make sure you have enabled permissions correctly, or if at all you have a directory set up for your socket.