Error guide / DKIM signature verification failed

DKIM fail: signature does not verify

A DKIM fail means the digital signature on your email did not match the key published in your domain's DNS. The recipient could not confirm that the message really came from you and was not altered on the way. As a result the mail loses trust: it lands in spam more often, and together with DMARC it may be rejected entirely.

What causes it

The DKIM record in DNS is usually at fault: the key is missing, was copied with an error, or went stale after a mail server change. Another cause is an intermediate service (a newsletter or forwarding) that changed the message in transit and broke the signature.

How to fix it

1. Find the DKIM selector (for example default._domainkey) and the public key in your mail settings.
2. Confirm the matching TXT record actually exists in DNS and was copied in full, with no line breaks or spaces.
3. If you changed hosting or mail providers, generate a new key and update the DNS record.
4. In cPanel, DKIM is enabled under Email Deliverability, which shows what is missing in DNS.
5. For third-party newsletters, add a separate DKIM record issued by that specific service.
6. Send a test email to Gmail and check the original to confirm DKIM shows pass.

Related errors

• 550 SPF check failed The 550 SPF check failed error
• Листи потрапляють у спам Emails going to spam
• DMARC policy reject (p=reject) DMARC reject: message blocked by policy
• 550 5.7.1 Message rejected The 550 5.7.1 rejected error