Please take a look at this picture of mail-tester.com saying that Your DKIM signature is not valid.

As you can see, the DKIM signature and public key are identical in term of text (characters) but the only problem is the spaces between them. I do not know how to fix this, or what is the proper way to edit a DKIM from zone record. Currently, I try to copy the DKIM signature shown in the page and manually paste it over to the DNS TXT record (public key). After refreshing the page, it passes the test, but after making another request, the spaces disappear and the test failed again.

What is the correct way to correct the DKIM public key so it matches the DKIM of the signature?

Thank you.

  • Did you put the email headers into DNS.... – Jacob Evans Oct 17 '18 at 0:15
  • I'm new to this DNS thing. What do you mean putting the email headers into DNS? @JacobEvans – cuzmAZN Oct 17 '18 at 3:14
  • maybe read blog.returnpath.com/how-to-explain-dkim-in-plain-english-2 it looks like you have no idea how dkim works, it's basically PKI, you have a private key to sign, and a public key to verify the signature. – Jacob Evans Oct 18 '18 at 13:35

The DKIM signature and the DKIM public key are not supposed to be identical.

You should have a pair of keys: a private key and a public key. The public key goes to the DNS TXT record. The private key is never published as-is: it is used by the mail server to create digital signatures for outgoing emails: this signature should be unique for each outgoing email.

The math behind the public-key cryptography ensures that only the holder of the private key can create DKIM signatures for the domain, but anyone with access to the private key can verify those signatures.

Verifying a DKIM signature does not mean just comparing the signature in an email to a DNS record to see if they match; instead, the verifier must use the public key from the DNS record to decrypt the b= part of the signature: if the decryption result matches a hash calculated in a specific way from the message body & headers, then the signature is genuine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.