DKIM simple and relaxed: diagnose message changes

Identify what was signed#

Find the DKIM signature’s signing domain, selector and canonicalization setting. Keep a copy of the received source. A visible DNS key alone cannot establish whether that particular message’s signature is valid.

Trace transformations#

Whitespace changes, appended footers and intermediary rewriting are useful investigation leads. Compare the message at the signing boundary with the received version. “Relaxed” handling tolerates some formatting changes; it does not make content rewriting harmless.

Fix the path, then test#

Try a controlled send through the same route with optional transformations disabled. If several systems modify outgoing messages, place signing appropriately in that flow. Use the receiver’s result and, where needed, an independent signature verifier; do not diagnose from a pasted key alone.