DomainKeys Identified Mail (DKIM) is one of the standard methods to protect emails from spam.

It provides a digital signature for email authentication.

But, you may get “DKIM signature not valid” error due to an incorrect entry in DNS record, DNS propagation delay & much more.

At Bobcares, we often get requests from our customers to resolve “DKIM signature not valid” error as part of our Server Management Services.

Today, we’ll see how our Support Engineers fix the issue with DKIM signature.

What is DKIM signature?

DKIM signature is a header added to email messages. It allows the mail server to validate the received emails by looking up the sender’s DKIM key to verify the encrypted signature.

Here’s an example of the DKIM signature:

v=DKIM;a=rsa-sha1;q=dns;d=example.com;i=user@example.com;s=jun2005.eng;c=relaxed/simple;t=1117574938;x=1118006938;h=from:to:subject:date;b=dzdVyOfAKCdLXdJOc9G2q8LoXSlEniSb
av+yuU4zGeeruD00lszZVoG4ZHRNiYzR

Let’s see what each tag is associated with.

• b = the actual digital signature of the contents (headers and body) of the mail message.
• h = the list of signed header fields, repeated for fields that occur multiple times
• t = the signature timestamp
• s = the selector
• c = the canonicalization algorithm(s) for header and body
• d = the signing domain
• a = the signing algorithm
• q = the default query method

How we set up DKIM signature

There are 4 basic steps to set up DKIM for email services.

1. Generate DKIM keys

The first step we take is to generate DKIM keys by following the steps.

1.1 We make use of DKIM generator tools available.
1.2 Next, we enter the Domain name (example.com) & DomainKey Selector (name of the key).
1.3 Then, we click Submit to generate the private & public keys.

2. Enter Public key to DNS Server

Adding the public key to the DNS server setting is the same for all control panels.

2.1 We go to Edit DNS Record > Add New Record.
2.2 Next, we enter the TXT record (keyname._domainkey.domainname.) & public key in the Value field.
2.3 Then, we save the settings.

3. Enter Private key to Email Server

No matter which email server you are using, it supports DKIM, it will have an interface to add private key.

3.1 We navigate to Domain > DKIM settings.
3.2 Next, we click enable DKIM & select the Private key file saved in the local machine.
3.3 Finally, we save the file.

4. Test DKIM Record

Before you try to send an e-mail, we check if the DKIM record is added properly. There is various DKIM checker tool/analyzer to test it.

After validation is done, this is the result it shows.

This is how our Support Engineers set up DKIM signature.

Errors & fixes with DKIM signature

Even after configuring DKIM record, we often see an error like “DKIM signature not valid”.

Let’s take a closer look at what are the causes & how our Support Engineers fixed it.

1. Incorrect entry in DNS record

Recently one of our customers approached us with an issue in DKIM record. In cPanel after the DKIM TXT record has entered in DNS configuration file, it resulted in an error like “DKIM signature not valid“.

So, our Support Engineers fixed this error by performing the following steps.

1. First, we logged into the cPanel with login credentials.

2. After that, we clicked on Advanced DNS Zone Editor option under Domains.

3. Now, we selected the domain from the drop-down list.

4. In Edit DNS Records we checked the TXT record.

5. We found that the entry was incorrect. So, we put the correct value for the DKIM record.

6. Finally, saved the file to reflect the changes made.

That fixed the problem & the user could validate the DKIM signature without any failure.

2. DNS Propagation delay

Similarly, in some cases, even after changing the settings in the DNS configuration file, customers reported that they get an error like “DKIM signature not valid“.

Usually, this is mainly because when you make any changes in DNS settings, it takes up to 24 – 48 hours for DNS propagation, depending on the TTL value entered in the DNS record.

So, in such cases, we ask our customers to wait until DNS propagates completely. Additionally, we check and ensure the DNS propagation status of the domain using DNS propagation tools/analyzer too.

Thus the problem was solved after DNS propagates completely.

[Having trouble with DKIM signature not valid error? We’ll fix it for you.]

Conclusion

To be more precise, the DKIM method is one of the standard practices to protect emails from spam, spoofing & phishing. Today, we saw how our Support Engineers set up DKIM signature & fixed the common errors related to it.