DKIM Fail: How to Fix Alignment and Verification Errors | DMARCguardSkip to main content<br>20 min readShare

Why DKIM Fails and How to Fix Every Type of Alignment Error<br>Of the 5,499,028 domains we scanned in our State of Email Authentication 2026 research, only 22.7% had a detectable DKIM record. That is the lowest adoption rate among all core email authentication protocols. Among the top 10,000 domains, adoption climbs to 38.9% — but even there, a 16.2 percentage-point gap separates the largest domains from everyone else.<br>When DKIM fails, your emails risk landing in spam or being rejected outright. And DKIM failure is not a single error. It is a family of failures — alignment mismatches, body hash verification errors, missing keys, expired signatures — each with a different root cause and a different fix.<br>Below, you will find every type of DKIM failure you will encounter in DMARC reports and email headers — with the exact diagnostic steps, CLI commands, and platform-specific configuration changes to resolve each one. If you are dealing with a broader DMARC issue, start with our DMARC Failed: The Complete Troubleshooting Guide for a full picture of DMARC authentication failures beyond DKIM.<br>Methodology note<br>Our scanner probed 6 common DKIM selectors per domain. Since DKIM records cannot be enumerated without knowing the selector, actual adoption may be 5-10 percentage points higher than reported. Source: DMARCguard State of Email Authentication 2026, February 2026.

What Does “DKIM Fail” Actually Mean?<br>So what is DKIM failure, exactly? DKIM failure is an umbrella term covering two distinct categories: verification failure and alignment failure . Understanding the difference is the single most important step in DKIM troubleshooting, because the fix for each is completely different.<br>DKIM failure occurs when the receiving mail server cannot verify a DKIM signature (verification failure) or when the domain in the DKIM signature does not match the domain in the email’s From header (alignment failure). DMARC evaluates both — a message must pass DKIM alignment, not just DKIM verification, to satisfy DMARC’s DKIM check.<br>How DKIM Verification Works<br>The DKIM verification process has three steps, defined in RFC 6376 Section 6.1:<br>Extract the signature tags. The receiving server reads the DKIM-Signature header and extracts the following:d=: signing domain, for example yourdomain.com, and<br>s=: selector tags, for example k2, k3, etc.

Look up the public key. The receiver queries DNS for a TXT record at {selector}._domainkey.yourdomain.com to retrieve the signer’s public key.<br>Validate the cryptographic hash. The receiver recomputes the hash of the message headers and body, then compares it against the hash in the signature using the public key. If they match, verification passes.<br>How DKIM Alignment Works<br>Alignment is a separate check, defined in RFC 7489 Section 3.1. DMARC requires the d= domain in the DKIM signature to match (or be a subdomain of) the RFC 5322 From header domain. A message can pass DKIM verification — the cryptographic signature is valid — but fail DKIM alignment because the signing domain does not match the From domain.<br>This is the number one source of confusion in community forums: admins see “DKIM pass” in raw authentication results and assume DMARC will also pass. It does not, unless the signing domain aligns with the From domain.<br>Our scan data quantifies the risk: 43.0% of DMARC-enabled domains (718,876 domains) rely on SPF-only alignment with no DKIM detected. If SPF fails — for example, when an email is forwarded — DMARC fails entirely for nearly half of all DMARC-protected domains (DMARCguard State of Email Authentication 2026).

DKIM verification checks the cryptographic signature. DKIM alignment checks whether the signing domain matches the From domain. DMARC requires both.How DKIM Alignment Affects Your DMARC Results<br>DMARC requires either SPF alignment OR DKIM alignment to pass — not both. But DKIM alignment is the more resilient of the two, because DKIM signatures survive email forwarding. SPF does not .<br>When a message is forwarded, the envelope sender changes, and SPF alignment breaks. DKIM, if the message body and signed headers remain intact, continues to pass.<br>Strict vs. Relaxed Alignment<br>Your DMARC record’s adkim tag controls how strictly DKIM alignment is evaluated:<br>Relaxed (adkim=r, the default): The d= domain in the DKIM signature must share the same organizational domain as the From header. A subdomain signature aligns with the parent domain.<br>Strict (adkim=s): The d= domain must exactly match the From header domain. Any subdomain mismatch causes alignment failure, even though the signature is cryptographically valid.<br>Scenariod= DomainFrom Headeradkim=r (Relaxed)adkim=s (Strict)Exact matchexample.com[email protected]PassPassSubdomain signingmail.example.com[email protected]PassFailESP signing (aligned)example.com[email protected]PassPassESP signing...