Why Does DKIM Fail, and How Do I Fix It?

How DKIM is checked

The sending server signs selected headers and a hash of the body with a private key, and adds a DKIM-Signature header with the domain (d=) and the selector (s=). The receiver fetches the public key from s._domainkey.d in DNS and checks both hashes (RFC 6376). Anything that breaks one of those steps fails DKIM.

What the result says

The receiver writes its verdict into Authentication-Results (RFC 8601):

Gmail turns a missing pass into bounces for bulk senders: 421 4.7.30 and 550 5.7.30 "didn't pass DKIM authentication", and 550 5.7.26 when SPF failed too. The email bounce decoder identifies them from the bounce text.

Fixes by cause

1. No key for signature. Look up the selector from the s= tag with the DKIM checker. If nothing is there, publish the TXT (or CNAME) record your sending tool shows, exactly as given, at selector._domainkey.yourdomain.com. New records can take up to a day or two to be visible everywhere.

2. Broken key record. A 2048-bit key is longer than 255 characters, so DNS stores it as several strings in one TXT record. Some DNS panels add quotes or line breaks; paste the value as the panel's help describes, then check it again.

3. Body hash did not verify. Something edited the email after it was signed: a disclaimer added by an outbound relay, a mailing list that adds a footer, or a server that re-encodes the body. Send a test straight from the mailbox to a Gmail address and compare with a copy that went through the relay.

4. Key mismatch. After rotating keys, the tool must sign with the new private key and DNS must publish the matching public key. Keep the old selector published until mail signed with it has been delivered.

5. Signed for the wrong domain. Turn on custom DKIM so d= is your domain; a signature from the tool's domain does not help DMARC.

Check it end to end

Send a test to a Gmail address, open Show original and look for dkim=pass header.d=yourdomain.com. The email header analyzer reads the result, the selector and the alignment with From in one pass. How to test SPF, DKIM and DMARC has the manual checks.

What we recommend at Outreach2day

Every domain we set up gets a 2048-bit DKIM key published on the domain and every mailbox signs with it, so the signature aligns with the From address. If you move a domain between providers, publish the new provider's key before you switch sending.