Need help?

Our experts have had an average response time of 13.14 minutes in February 2024 to fix urgent issues.

We will keep your servers stable, secure, and fast at all times for one fixed price.

How to fix error “DKIM-Result: fail (bad signature)” and prevent mail bounce

by | Sep 14, 2018

DKIM-Result: fail (bad signature)” is an error reported by www.appmaildev.com – a DKIM validation website.

It means that the mail sender’s domain (say sender.com) failed an anti-spam test called DKIM, that is used to block fake or altered mails.

Here at Bobcares.com, we help hosting providers (web hosts, VPS hosts, etc.) resolve such errors as part of our Outsourced Tech Support services.

A typical error message looks like this:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sender.com; h=subject:subject:from:from:to:reply-to; s=senderdkim; t=1536906841; x=1537770842; bh=ULXXzArVdLLQL8y+JLPkvBqQfg=; b=bJAhBd4F2fF5N0u+kd2eh4TbkrukJyzVlPrJ5Pf0uqKu5TGFjXtjitO53FCgl1zJzYIW401dP8ui6Y= 

Signed-by: user@domain.com 

Expected-Body-Hash: 5XCn6bdCwq7YPjOROULXXzArVdLLQL8y+JLPkvBqQfg= DKIM-Result: fail (bad signature)

 

 

What is the error DKIM-Result: fail (bad signature)?

DKIM enabled mail servers ensure that the mail contents are not altered and the sender ID is not fake through two layers of tests.

They are:

  • Create a unique ID (aka Hash) for each mail  – The mail server uses the parts of a mail (eg. Sender’s ID, Recipient’s ID, Subject, Time, etc.) to create a unique Hash. This will never be the same for another mail.
  • Encrypt the code – This Hash is then encrypted using a secret Private Key which can be decrypted only via a Public Key. This public key is published as a DNS record of the sender’s domain.

For a mail to pass the DKIM test, the recipient server should be able to (1) decrypt the mail using the public key, and (2) be able to regenerate the Hash using the same parts of the mail the sender server used.

Unfortunately these tests sometimes fail, and lands the sender’s mail in spam folders.

When mail users query sites such as www.appmaildev.com to troubleshoot the issue, they see the error “DKIM-Result: fail (bad signature)”.

 

What are the causes of DKIM-Result: fail (bad signature)?

We’ve seen this error pop-up usually during a new DKIM setup, or after an application upgrade or after a server migration.

In almost all cases, we’ve found the issue was caused due to errors in generating Hashes or in setting up the public key.

Here are the top 3 issues:

 

1. Wrong or corrupted DNS records

The DKIM public key is published as a DNS record. It looks something like this:

Public key - Long string

That long line of characters starting with “p=“is the public key. As you can see, the public key can span over several lines.

To set this DNS record, server owners copy-paste the key into the configuration window. In that process they often introduce whitespace or newline characters which breaks the public key.

We’ve also seen cases where webmasters use an old public key which doesn’t match the private key used to encrypt the message Hash.

Solution : The fastest way to fix this is to generate a new public-key private-key pair, and update the settings without syntax errors. This avoids a lot of digging around to find the right key pair, or to fix any missing characters in the existing key.

 

2. DKIM server config errors

Some DKIM implementations use an independent service such as OpenDKIM.

We’ve seen cases where the service either doesn’t run, or the mail server is unable to connect to it.

For eg. OpenDKIM communicates with the mail server through port 8891 in Ubuntu servers. But this connection can fail if OpenDKIM crashed for some reason or if the port is blocked by firewall.

When the mail server is unable to communicate to the DKIM service, message Hash will not be generated, and the verification will fail.

Solution : To solve this error, we look at exactly why the DKIM service is inaccessible. We setup auto-restart facilities to recover from service crashes, and fix firewall rules to make sure the DKIM port is always accessible.

 

3. App errors that insert chars or spaces

There are DKIM implementations where the DKIM header is inserted by a web application, and not the mail server.

We’ve seen some of these applications insert a white space or an extra character in the headers (for content wrapping) after the Hash ID is generated.

When the header is changed, the Hash will no longer match the mail, and the verification will fail at the recipient’s server.

Solution : Since this is a bug in the application, the fastest way to solve it is to disable DKIM generation until the app bug is fixed by developers. In cases where DKIM is mandatory, we’ve setup DKIM services at the mail server in place of the apps.

 

Conclusion

DKIM-Result: fail (bad signature) is an error that happens when DKIM signature doesn’t match the mail body. It can happen due to modified mail content or corrupted/wrong DKIM DNS records. Today we saw the top 3 causes our Support Engineers have seen, and the fixes for them.

 

PREVENT YOUR SERVER FROM CRASHING!

Never again lose customers to poor server speed! Let us help you.

Our server experts will monitor & maintain your server 24/7 so that it remains lightning fast and secure.

SEE SERVER ADMIN PLANS

var google_conversion_label = "owonCMyG5nEQ0aD71QM";

0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

Privacy Preference Center

Necessary

Necessary cookies help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies.

PHPSESSID - Preserves user session state across page requests.

gdpr[consent_types] - Used to store user consents.

gdpr[allowed_cookies] - Used to store user allowed cookies.

PHPSESSID, gdpr[consent_types], gdpr[allowed_cookies]
PHPSESSID
WHMCSpKDlPzh2chML

Statistics

Statistic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.

_ga - Preserves user session state across page requests.

_gat - Used by Google Analytics to throttle request rate

_gid - Registers a unique ID that is used to generate statistical data on how you use the website.

smartlookCookie - Used to collect user device and location information of the site visitors to improve the websites User Experience.

_ga, _gat, _gid
_ga, _gat, _gid
smartlookCookie
_clck, _clsk, CLID, ANONCHK, MR, MUID, SM

Marketing

Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers.

IDE - Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.

test_cookie - Used to check if the user's browser supports cookies.

1P_JAR - Google cookie. These cookies are used to collect website statistics and track conversion rates.

NID - Registers a unique ID that identifies a returning user's device. The ID is used for serving ads that are most relevant to the user.

DV - Google ad personalisation

IDE, test_cookie, 1P_JAR, NID, DV, NID
IDE, test_cookie
1P_JAR, NID, DV
NID
hblid

Security

These are essential site cookies, used by the google reCAPTCHA. These cookies use an unique identifier to verify if a visitor is human or a bot.

SID, APISID, HSID, NID, PREF
SID, APISID, HSID, NID, PREF