DKIM (DomainKeys Identified Mail) is a vital email authentication tool for digital marketers, even more so after February 2024. It adds a digital signature to your emails, ensuring recipients they’re coming from a legitimate source and haven’t been tampered with. But even the most robust tools can malfunction or have configuration issues. 

Here, we’ll explore common DKIM failures and how to identify them using DMARC reports:

Typos and Copy-Paste Errors:

Public keys are long strings, often exceeding 1000 characters, and a single character error can render them useless. These mistakes often happen during manual configuration or copy-pasting from one platform to another. Here are some specific ways errors can occur:

  • Copying extra characters: Sometimes, additional characters like spaces or quotation marks from the surrounding text inadvertently get copied along with the key. This happened to me today, I had an extra space in a new DKIM Key I was setting up, so beware when creating new records.
  • Missing characters: If you don’t carefully copy the entire key, even a single missing character can invalidate the signature.
  • Line breaks not handled properly: Public keys can span multiple lines, and some platforms might not handle line breaks correctly during copy-pasting. This can introduce formatting errors into the key.

Solution: Double-check all key entries for accuracy. Consider using a key management tool to automate DKIM configuration and minimize typos.

Selector Collisions: A Clash of Identities

Imagine giving everyone the same nickname. Chaos ensues! Similarly, using the same DKIM selector for multiple services can lead to conflicting signatures. Each service (ESP, marketing automation platform) should have a unique selector to ensure proper identification.

Solution: Assign distinct selectors to each service using DKIM. This prevents confusion and ensures clear authentication.

The Vanishing Key: Accidental DNS Deletion

During routine DNS record housekeeping, it’s easy to mistakenly delete a DKIM public key that’s still in use. This leaves your emails unsigned and unauthenticated.

Solution:  Maintain a clear inventory of your DKIM keys and their corresponding selectors.  When managing DNS records, double-check that you’re not deleting a key that’s actively used for DKIM signing.

Relic of the Past: Outdated Public Keys

DKIM keys, like car keys, need periodic rotation for security reasons. However, if you update the signing key on your email server but forget to update the corresponding public key in your DNS record, DKIM verification fails.

Solution: Implement a system for automatic or scheduled DKIM key rotation. Ensure the public key in your DNS record is always up-to-date with the latest key. Many ESPs manage this with multiple cnames to ensure you have the right records.

Size Matters: Short Keys and Security Risks

While keys shorter than 1024-bits are considered insecure and highly vulnerable to brute-force attacks, keys longer than 2048-bits may not be universally supported by all email providers due to size limitations. 2048-bit keys offer a strong balance between security and compatibility.  Check with your email service provider to confirm their supported key sizes.

Solution: Generate and use 2048-bit DKIM keys for optimal security.  Many email service providers offer tools to assist with key generation. Larger or more secure keys, like 4096-bit keys or Ed25519, are not widely support at this time by sending or receiving networks

Misaligned Keys: Signing with the Wrong Key

Improper configuration, particularly when using multiple email sending platforms, can lead to a situation where the wrong private key is used to sign emails. This results in DKIM verification failures.

Solution: Carefully review your DKIM configuration for each email sending service. Ensure the correct selector and private key pair are used for signing.

Your DMARC Report: A Window into DKIM Health

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a powerful tool that provides valuable insights into email authentication, including DKIM. By implementing DMARC and analyzing the reports, you can identify DKIM failures like those mentioned above. These reports highlight issues such as:

  • Alignment failures: When the signing domain (indicated by the DKIM selector) doesn’t match the domain name in the email header.
  • Signature failures: When the DKIM signature itself is invalid, often due to key mismatches or formatting errors.

By proactively addressing these common DKIM failures and leveraging DMARC reports, you can ensure your emails are properly authenticated and reach their intended audience. Remember, a healthy DKIM system is essential for building trust and maintaining a positive sender reputation. Read up on common SPF errors here.