Watch my domain

DKIM guide

DKIM fail and "body hash did not verify"

Why DKIM signatures fail, what “body hash did not verify” means, and how to fix each cause.

What DKIM fail means

The email carried a DKIM signature, but the inbox couldn’t verify it. Either it couldn’t find the public key in your DNS, or the email changed after it was signed. You’ll see dkim=fail in the email’s headers, often with a reason in brackets.

"Body hash did not verify"

This reason means the body of the email changed between being signed and being checked. Common culprits:

  • An email security gateway or antivirus adding a footer or disclaimer.
  • Signature tools that add a company signature after the email is sent.
  • Mailing lists that add an unsubscribe footer.
  • Forwarding services that rewrite the message.

Fix it by making the change happen before the email is signed, or by turning the change off. If a mailing list does it, that list’s own DKIM signature should cover the forwarded copy.

Other reasons DKIM fails

  • No key found. The record at selector._domainkey is missing, mistyped or was removed during a key change.
  • The key doesn’t match because the provider rotated keys and the old record is still published.
  • Headers were changed, for example a gateway adding [EXTERNAL] to the subject.
  • A long key was cut short by a DNS provider that limits TXT length.

How to fix it

1

Check the key is published with the DKIM checker. Use the selector from the email’s DKIM-Signature line (the s= value).

2

Send a test to a Gmail address, open Show original and read the DKIM result and reason.

3

Find what changes the email on the way out: gateways, signature tools, footers.

4

Republish the key from your email provider if it’s missing or out of date: see the guides for Google Workspace and Microsoft 365.

Check your DKIM

Enter your domain, and the selector if you know it.

Open the DKIM checker