dkim signature verification failed after mail forwarding

TL;DR

Forwarding breaks DKIM when the forwarder changes anything the signature covers: the body, a signed header, or line endings and encoding. List servers that add footers, gateways that rewrite subject lines, and mailing software that re-wraps MIME are the classic causes. Find what changed by comparing the message as signed with the message as received, then use a forwarding method that preserves the body or adds ARC.

dkim signature verification failed after mail forwarding

Use this when

• DKIM passes on direct mail but fails after a mailing list, helpdesk or forwarding hop.
• Only recipients behind one particular forwarder report dkim=fail.

Not for this skill when

• DKIM fails on the first hop before any forwarding. That is a signing fault, not a forwarding fault.
• SPF fails after forwarding but DKIM holds. That is expected SPF behaviour handled by alignment.

Steps

1. Take one failing forwarded message and one passing direct message from the same sender and compare their DKIM-Signature headers and signed header lists. Verify: you know which headers were signed.
2. Diff the bodies: look for an added footer, disclaimer, tracking rewrite or MIME re-encoding introduced by the forwarder. Verify: any body change is identified by name.
3. Check whether the forwarder added ARC headers and whether the receiver honoured the ARC chain. Verify: ARC presence and receiver handling are known.
4. Remove the modification where you control the forwarder: disable footer insertion and subject tagging for signed mail, or configure the list to leave the body intact. Verify: a test forwarded message arrives byte-identical in its signed parts.
5. If you do not control the forwarder, rely on ARC sealing at each hop and on receivers that validate it, and keep DMARC alignment on DKIM so SPF loss does not matter. Verify: forwarded test mail shows dmarc=pass via DKIM.

Variant phrasings

dkim fails after mailing list footer added

The list-server variant naming the specific body change.

arc headers forwarding dkim preservation

The fix variant for uncontrolled forwarders.

Compatibility: RFC 6376 DKIM, RFC 8617 ARC, common list and forwarding gateways.

Why it happens

A DKIM body hash is computed over the exact body bytes. Any later insertion changes the hash even when the visible text looks the same. Header signatures fail the same way when a signed header such as Subject is edited in transit.

Edge cases / pitfalls

• Relaxed canonicalisation tolerates whitespace changes but not added content. A footer still breaks it.
• SRS fixes SPF rewriting for forwarding; it does nothing for DKIM. Do not treat SRS as a DKIM fix.
• Some forwarders strip and re-sign with their own domain. That verifies, but alignment with the original From domain is lost.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_a2AvsDHiSjyVfB6qasEIvQ