3

I'm trying to figure out why a lot of emails from one of my sites are not getting through (in particular sky.com and gmail.com).

With my server, we have a tool that generates the DNS records for us:

RECORD            TTL         TYPE      VALUE
------            ---         ----      -----
_domainkey        3600   IN   TXT      "t=y; o=~;"
mail._domainkey   3600   IN   TXT      "k=rsa; p=xxxx"

(xxx is the full key)

This is what I have in my DNS record TXT records:

enter image description here

mail-tester.com comes back with this (which all looks good);

enter image description here

...yet mxtoolbox comes back with:

enter image description here

enter image description here

The frustrating part is that if I check the original email on my own gmail.com account, it comes back as DKIM valid:

enter image description here

What is the DKIM-Signature Not Verified error telling me? I'm at my witts end trying to get deliverability up (I've tried testing via GlockApps and it still comes back with lots of rejections for whatever reason). I must be missing something

UPDATE 2: Unfortunately MXToolbox is still ranking this as a problem. Every other tool says its fine though, so I'm wondering if its a false positive. Using GlockApps I can now see its only the Gmail stuff that gets bounced out of their tests:

enter image description here

I've read up about it - and it sounds like we may have shot ourselves in the foot when informing people about the crappy GDPR stuff that came out a while back. We emailed everyone (before it came in), to make them aware we would not be able to contact them if they don't give us permission. Maybe gmails filters picked that up as spam (as quite a lot of our users are on gmail), and punished us for it. Oh the irony! So now it sounds like the only way around it, is to ask people to check their SPAM box (and mark as "not spam")

3
  • Regarding your DKIM-Signature Not Verified is it still an issue? Because as far as I know it is only related to you have published the wrong DKIM key to your DNS server, which means email cannot be verified due to using the wrong key. Commented Apr 19, 2021 at 8:06
  • 1
    @LasseMichaelMølgaard it was actually a bug in mxtoolbox's testing tool. The DKIM was indeed valid, and working fine. It was just their silly system telling me it wasn't, and sending me on a wild goose chase! Commented Apr 20, 2021 at 5:54
  • 1
    I can confirm I had the same experience with mxtoolbox.com falsely reporting that my dkim doesn't pass verification. Passes for body only. I assume their mail server is incorrectly messing with headers before it gets to their dkim validator. Commented Jul 12, 2022 at 6:11

2 Answers 2

2

Well for starters: Your TXT record is wrong.

If you are sending mail from the domain example.com with a key named mykey (aka the selector), then the syntax is:

mykey._domainkey.example.com     IN TXT    "v=DKIM1; p=xxx"

You might also want to add t=s.

When you are confident that key signing and verification works, then I would recommend you add a DMARC and ADSP resource record, because it informs receiving mail server about what it should do, in case it receives a mail that is unsigned or using wrong key.

Syntax is simple enough (based on my own mail server settings):

_adsp._domainkey.example.com  IN TXT  "dkim=all"
_dmarc.example.com            IN TXT  "v=DMAR1; p=quarantine;  sp=reject; pct=100; adkim=s; aspf=s; rua=mailto:[email protected]; ruf=mailto:[email protected]; rf=afrf; ri=86400; fo=1

UPDATE

If you send a test mail to for instance a Gmail account, then there is an easy way to see if DKIM and DMARC is up and running.

I have enabled DKIM for my own domain molgaard.eu, so among others an email from me to Gmail will contains these headers:

Authentication-Results: mx.google.com;
       dkim=pass [email protected] header.s=mar2018 header.b=db8+ExPV;
       spf=pass (google.com: domain of ... as permitted sender) smtp.mailfrom=...;
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=molgaard.eu

<SNIP>

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=molgaard.eu; 
h=content-language:x-mailer:content-type:content-type:mime-version
:message-id:date:date:subject:subject:from:from; s=mar2018; t=1583565649; 
x=1585380050; bh=...; b=...

The selector for my mails is called mar2018, since that is the month and year I made the key. :-)

And as you can see from Authentication-Results, both DKIM and DMARC passes (and SPF too), which means mails from my mailserver should land in peoples inbox - instead of a spam folder. :-)

And actually my policy a bit more strict, since I have declared in my DMARC record, that any mail not signed or signed with wrong key should be tossed out instead of landing in any folder at receiver. :-)

4
  • thanks for that. I'm a bit confused though. The domain is educationusingpowerpoint.co.uk. I thought it was just mail._domainkey. I tried adding it with the domain as well - ie mail._domainkey.educationusingpowerpoint.co.uk, but Linode always converts it to remove the domain part. Where does the "key" come from? (I'm just using the built in DKI*M stuff with VestapCP). UPDATE: Ah I see what you mean now - I was missing the v=DKIM1; bit from the value. I've updated that, and will wait to see how it works after the DNS has updated :) Commented Mar 6, 2020 at 11:34
  • BTW in our exim4.conf.template file we have: dkim_selector = mail Commented Mar 6, 2020 at 11:37
  • thanks, but still doesn't validate :( mxtoolbox.com/deliverability/… (hopefully you can see that) Commented Mar 6, 2020 at 13:39
  • 1
    Try again in 12-24 hours or so. DNS have a habit of not being update DNS records worldwide for a while - giving you false results when you test. An alternate way is to send a test mail to a Gmail account and read the headers. Updating my answer with an example of waht to look out for. Commented Mar 7, 2020 at 7:23
1

do not trust MXtoolbox for this particulat DKIM check. I personally saw several times such false positives in MX toolbox

  1. revert DMARC policy to "none" for some time
  2. use Glock Apps to improve message content to get off Gmail spam filters
  3. use one of DMARC reports processing systems (EasyDMARC, DMARC Analyzer, Dmarcian) to identify all legitimate souses and make them DMARC compliant and only after that consider transitioning of domain policy to "rejects"
2
  • 1
    thanks - I've actually signed up for a PAYG on GlockApps, so I'm hoping I can improve. I'm wondering if I need to go down the route of asking our Gmail users to mark as "not spam" when we send to them. Our email content is not spammy at all. We also send a plain text and html version. I guess we will just have to see how it goes :) Commented Mar 9, 2020 at 6:53
  • 1
    definitely, it worth to ask you Gmail users to mark you emails as "not spam", to improve situation. Not familiar with GlockApps' DMARC data visualization, so cannot express my opinion re how much that will help you. Ony familiar with the systems I mentioned earlier
    – Zonder
    Commented Mar 9, 2020 at 13:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .