DKIM survives forwarding where SPF breaks, carries domain reputation across sending IPs, and is the most reliable path to DMARC alignment for third-party senders.
Mistake 1: Signing with the ESP's domain (d=esp.com) instead of yours, which passes DKIM but fails DMARC alignment#
Why it hurts: this undermines DKIM signing at the point where mailbox providers make their decision, and it is rarely surfaced by your own tooling until placement drops.
Fix: Generate a 2048-bit key pair in your ESP or mail server (1024-bit keys are considered weak).
Mistake 2: Copying the public key with line breaks or quotes broken, producing a permanent verification failure#
Why it hurts: this undermines DKIM signing at the point where mailbox providers make their decision, and it is rarely surfaced by your own tooling until placement drops.
Fix: Publish the public key as a TXT record at selector._domainkey.yourdomain.com.
Mistake 3: Modifying message bodies after signing (footers injected by gateways) which invalidates the signature#
Why it hurts: this undermines DKIM signing at the point where mailbox providers make their decision, and it is rarely surfaced by your own tooling until placement drops.
Fix: Enable signing in the sending platform and confirm the d= tag in outgoing headers matches your organizational domain.
Mistake 4: Never rotating keys, leaving a compromised key valid indefinitely#
Why it hurts: this undermines DKIM signing at the point where mailbox providers make their decision, and it is rarely surfaced by your own tooling until placement drops.
Fix: Send a test to a seed address and inspect the Authentication-Results header for dkim=pass.
Frequently asked questions#
What is a DKIM selector?
A label that lets one domain publish multiple keys. The selector appears in the s= tag and forms the DNS name selector._domainkey.domain.
Why does DKIM pass but DMARC fail?
Alignment. DMARC requires the d= domain to match the From header domain. If your vendor signs with their own domain, set up a custom DKIM domain with them.
Can I use one DKIM key for all my ESPs?
You can publish separate selectors per vendor. Never share private keys between platforms.