AUTHPROBLEM.comEmail Authentication Analysis
Common DKIM Authentication Problems
In a combined authentication check, DKIM is the message-integrity and signing-domain test. It can rescue DMARC when SPF fails during forwarding, but only if the message remains unchanged and the DKIM signing domain aligns with the visible From domain.
| DKIM Concern | Why It Matters |
|---|---|
| Selector not published | The sender signs with a selector that cannot be found in DNS. |
| Provider-domain signing | The message has DKIM, but the signing domain is not aligned with the visible From domain. |
| Message changed later | A gateway, footer, disclaimer, or list processor changes signed content after DKIM signing. |
| Weak or stale key | Old selectors remain in use, or keys are shorter than current operational expectations. |
| CNAME/TXT confusion | Delegated selectors are mixed with local TXT records or point to the wrong target. |
A selector lookup confirms the public DNS key, but real DKIM success also depends on the sending system using the matching private key and the message not being changed after signing.
Best Practices
- Check the selector used by real messages, not just the selector expected in documentation.
- Use aligned DKIM signing for every major sender that supports it.
- Keep old selectors available during rotation windows.
- Test after gateways, disclaimers, scanners, or list software have processed the message.
For combined diagnostics, DKIM findings are best grouped as selector DNS, signing setup, key quality, message modification, alignment, and operational rotation issues.