Why Is Your DKIM Signature Not Verified?

You sent a perfectly valid email. The DKIM signature is there. The key matches. Yet the receiver’s server says “not verified.” Why? It’s not always about a broken key or a misconfigured domain. Often, it’s a silent mismatch in how the email’s body was processed during transit. Even a single space, line break change, or character encoding tweak can break DKIM validation if the canonicalization method doesn’t align between sender and receiver. This discrepancy usually comes down to body canonicalization—specifically, whether the sender used strict or relaxed rules when signing the message, and whether the receiver expects the same. The result? A legitimate email fails verification simply because the content changed in a way that wasn’t expected. And that’s where things go wrong.

Key takeaways

  • DKIM validation can fail even with a correct signature if the email body changes during transit due to mismatched body canonicalization.
  • Strict canonicalization requires exact byte-level match; relaxed allows minor formatting changes and is more forgiving of transit modifications.
  • The root issue is not always sender error—it's often a mismatch between how the sender signs the body and how the receiver expects it to be processed.

What Is Body Canonicalization in DKIM?

Body canonicalization in DKIM is the process of standardizing an email’s body before signing or verifying it, ensuring the signature stays valid even after minor, non-content-altering changes during delivery. It handles differences in line endings, extra whitespace, and formatting that don’t affect the message’s meaning. The DKIM specification allows two methods: relaxed and strict, which differ in how strictly they normalize the body.

How It Works in Practice

When an email is signed with DKIM, the sender’s server normalizes the body using either relaxed or strict canonicalization. This standardized version is then hashed and signed. Later, when the receiving server verifies the signature, it applies the same canonicalization method to the received body. If the resulting hash matches the one in the signature, the email passes verification — even if it was reformatted during transit.

For example, extra spaces between words or different line endings (CRLF vs LF) won’t break a DKIM signature if relaxed canonicalization is used. This makes it more forgiving and widely adopted. But strict canonicalization requires an exact match, so even minor formatting differences can cause verification to fail.

Both methods are defined in RFC 6376, the core DKIM specification. The relaxed method, which is more common, ignores whitespace variations and standardizes line endings. Strict mode requires the body to match the signed version exactly, including all formatting. This makes it more rigid but also more stringent.

You’ll typically see issues with “DKIM signature not verified” when the receiving server uses strict canonicalization but the email’s body was altered with minor formatting changes — like a newline added, or a space replaced — during transit or processing. This happens often with email clients or bulk mailing systems that modify content slightly. The signature fails because the hash no longer matches, even though the message content is identical.

If you're sending bulk emails and seeing sudden DKIM issues, check whether your email tools are applying relaxed or strict canonicalization. Most major providers use relaxed by default. But some strict implementations, especially in enterprise environments, expect exact body matches. You can test this behavior with a real inbox placement test before sending.

Use MailTester’s inbox placement tool to simulate how your emails land across real inboxes, including DKIM validation checks. It helps catch issues like this before you hit your audience.

Strict vs Relaxed Mode: How They Differ

DKIM signatures use either strict or relaxed body canonicalization to validate email content. Strict mode checks every byte exactly as sent—any change, even a single space or line break, breaks the signature. Relaxed mode normalizes formatting so minor delivery changes don’t invalidate the signature. Most servers use relaxed mode, making it the practical standard.

How Strict Mode Works

Strict mode treats your email body as a byte-by-byte match. If a single space is added, removed, or a line break changes from CRLF to LF, the signature fails. This is precise but brittle—common email delivery systems modify formatting subtly during transit, making strict mode rarely usable in real-world sending.

Why Relaxed Mode Is Standard

Relaxed mode normalizes whitespace: multiple spaces become one, line breaks are standardized, and carriage returns are ignored. This makes the signature resilient to typical changes caused by gateways, forwarding, or rendering engines. Because of this, nearly all mail providers—including Gmail, Yahoo, and Outlook—use relaxed mode by default.

Think of it like this: imagine sending a typed letter with exact spacing. A strict system rejects it if you press space twice instead of once. Relaxed mode sees that you meant to space once and accepts it. This is why relaxed mode dominates. It’s not about reducing security—it’s about practicality.

According to RFC 6376 (the DKIM standard), relaxed body canonicalization is explicitly designed for interoperability. It’s a core part of the specification for a reason: email delivery isn’t perfect, and small changes are inevitable. The IETF’s documentation at rfc6376.org confirms that relaxed mode is the default for good reason.

Most senders don’t even configure strict mode intentionally. It’s only enabled in niche, controlled environments—like internal corporate systems or systems with fully predictable content pipelines. Even then, it’s usually a misconfiguration, not a deliberate choice.

That’s why checking your DKIM signature before sending matters. If you’re seeing "signature not verified" errors, it’s often not because the signature is broken—it’s because the delivery system applied relaxed mode, and your sender didn’t account for it. Make sure your DKIM signing process uses relaxed body canonicalization unless you’re in a custom setup.

Use tools like the MailTester email checker to validate how your DKIM signature holds up during delivery. It simulates real-world conditions, including common normalization, so you can catch issues before they hurt deliverability.

When Does DKIM Fail Due to Canonicalization Mismatch?

DKIM can fail even with a valid signature if the receiving server expects a different canonicalization mode—usually relaxed—than the one used during signing. If your system signs with strict mode but the recipient enforces relaxed, or vice versa, the signature validation will fail. This mismatch often occurs when third-party email platforms or gateways alter message structure during delivery, especially when rewriting headers or body content.

Strict vs Relaxed: The Core Difference

DKIM uses canonicalization to normalize the message before signing, so minor changes don’t invalidate the signature. Strict mode preserves every whitespace, line break, and header format exactly as sent. Relaxed mode, however, ignores insignificant formatting differences—like extra spaces, line breaks, or header folding—that shouldn’t affect content.

Let’s say you use a cloud email service that defaults to strict canonicalization. Meanwhile, the receiving mail server expects relaxed. Even if your signature is mathematically correct, the receiver sees differences in the body or header structure and rejects the signature. This isn’t a flaw in your email—it’s a mismatch in expectations.

Why Third-Party Systems Break It

Many email platforms or forwarding services apply their own canonicalization rules. Tools like marketing automation platforms, message queuing systems, or legacy gateways often modify the message during transit. If they reformat headers, adjust line breaks, or rewrite content, they may trigger a canonicalization mismatch even if your original signature was correct.

Relaxed mode exists to handle such real-world variations. But enforcing strict mode by default—especially in systems not accounting for common header/body normalization—leads to avoidable failures. According to RFC 6376, relaxed canonicalization is the most widely supported setting, and receiving servers are expected to handle it.

Most email clients and infrastructure are built with relaxed mode as the default. If your signing system uses strict without a clear reason, you risk widespread delivery failures—especially with big providers like Gmail, Outlook, or Yahoo.

Always check your email system’s DKIM configuration. If you’re using tools like SendGrid, Mailchimp, or HubSpot via integrations, verify their default canonicalization setting. When in doubt, test with a real inbox placement tool to see whether DKIM passes on major inboxes. You can test your deliverability setup directly using MailTester’s inbox placement tester.

How to Diagnose a DKIM Canonicalization Issue

DKIM signature validation fails when the body canonicalization used during signing doesn’t match what the receiving server applies. The most common cause is a mismatch between strict and relaxed body canonicalization—when the signing server uses strict but the receiver uses relaxed (or vice versa). To diagnose it, inspect the raw email headers for the DKIM-Signature, check how the body was canonicalized at signing versus delivery, and simulate delivery with a tool like MailTester’s inbox-placement tester.

Step-by-Step Diagnosis

  1. Examine the raw MIME headers for the DKIM-Signature header. Look for the b= field, which contains the digital signature. This field is derived from the canonicalized body. A mismatch here often points to a canonicalization issue during signing or verification.
  2. Compare the signed body with the delivered body. Use the full email source from both the original send (before delivery) and the final received copy (e.g., in a test inbox). Check for discrepancies in whitespace, line breaks, or content formatting—these are the most frequent causes of strict vs. relaxed mismatches. The DMARC specification defines body canonicalization but allows flexibility in practice.
  3. Use inbox-placement testing to observe real-world behavior. Tools like MailTester’s inbox placement tester simulate delivery across major providers. This shows whether the DKIM signature verifies in practice, not just in theory. If it fails only in certain inboxes, the receiver’s canonicalization policy is likely involved.
  4. Confirm the canonicalization mode used by your signing server. Check if your email service (SendGrid, Mailgun, Postmark, etc.) applies relaxed or strict body canonicalization. Relaxed canonicalization strips trailing whitespace, while strict preserves it. If your server uses strict but the receiver uses relaxed (or vice versa), the signature will fail verification.
  5. Validate with a third-party tool. Use a tool like MailTester’s email checker to test individual addresses and inspect their DKIM signatures in context. This helps isolate whether a failure is due to a recipient’s policy or a misconfiguration.

Why It Matters

If your DKIM signature isn’t verified, your emails may be rejected or marked as spam. Even with proper SPF and DMARC, a signature failure breaks the authentication chain. The receiving server doesn’t know if the email was tampered with or simply misprocessed due to canonicalization differences. You won't see a bounce, but inbox placement drops. Let's ensure your messages stay trusted—verify the body alignment from send to receive.

Using MailTester to Verify DKIM & Body Canonicalization

You can catch DKIM signature failures caused by strict vs relaxed body canonicalization before they hurt deliverability. MailTester’s inbox-placement test simulates real delivery to Gmail, Outlook, and Yahoo, checking whether your signed emails pass verification on actual receiving servers. It flags mismatches due to how body content is normalized during signature validation—something standard tools often miss.

How MailTester Detects Body Canonicalization Issues

  • Use MailTester’s inbox-placement test to simulate delivery to major providers and see if your DKIM signature verifies in real-world conditions.
  • Test individual messages with the real-time verification API to inspect headers and signature behavior without sending.
  • Check if your email body is being altered (e.g., by adding hidden whitespace, line breaks, or encoding) during transport—these changes break DKIM when canonicalization mode is mismatched.
  • Some providers use strict body canonicalization (preserving all whitespace), others use relaxed (ignoring formatting changes). MailTester checks both, revealing where your setup fails.
  • Even if SPF and DMARC pass, DKIM can still fail due to how the body is processed. MailTester surfaces these subtle mismatches so you can fix them before bulk sending.
  • Verify changes to your email system—like switching templates or email service providers—using the inbox-placement test to ensure DKIM still passes across providers.

Why This Matters for Deliverability

DKIM signature failure leads to delivery drops, especially with providers like Gmail and Yahoo, which enforce strict verification policies. According to RFC 6376, the canonicalization method applied during DKIM signing must match the receiving server’s expected mode. Misalignment, even if subtle, breaks the chain of trust.

Let’s say your ESP applies relaxed body canonicalization but your receiving server expects strict. The signature will fail—even if the key is valid. MailTester tests for this exact scenario by mimicking real receiving behavior.

Pro tip: Always test new email configurations or template changes before rolling them out. You’d be surprised how often minor formatting edits in HTML—like extra commas or line-ending adjustments—break DKIM when canonicalization differs.

Use the bulk verification feature to test all your outbound emails at scale and catch these issues across your list.

How to Fix DKIM Canonicalization Mismatches

If your DKIM signature isn't verified, it's likely because your email’s body was altered after signing—especially due to strict body canonicalization. Most receivers expect relaxed body canonicalization, the industry standard. Ensure your email system or ESP uses relaxed mode by default, avoid post-signing formatting changes, and verify that automated templates don’t scrub whitespace or line endings. If strict mode is used, confirm the receiving server supports it—this is rare.

Fixing the root cause

  • Verify your ESP or email platform uses relaxed body canonicalization by default—this is the standard across major providers like Gmail, Outlook, and Yahoo.
  • Eliminate any post-signing scripts that normalize line endings (CRLF → LF), trim whitespace, or reorder content—these break DKIM checks even with relaxed mode.
  • Review automated email templates or content engines (like those in HubSpot, Klaviyo, or SendGrid) that may alter formatting before sending—these can introduce invisible body changes.
  • Test your DKIM signature using tools like MXToolbox’s DKIM verifier to simulate how receivers process the message and detect mismatches early.
  • If strict body canonicalization is required (extremely rare), confirm that all recipient domains explicitly support it—most do not, and their servers will reject the signature.

Prevention and verification

  • Before sending bulk campaigns, use MailTester’s bulk verification to catch invalid or misconfigured addresses that may stem from poor DKIM setup.
  • Validate individual addresses with MailTester’s email checker to see if they receive and pass checks like DKIM validation.
  • Run inbox placement tests via MailTester’s inbox tester to confirm your emails reach inboxes without being flagged or rejected due to signing issues.
  • Always log and monitor DMARC reports to catch DKIM failures at scale—and investigate any signature discrepancies promptly.
DKIM fails not because of malicious intent, but because of unintended formatting changes. When in doubt, stick to relaxed mode and audit your entire delivery pipeline.

How MailTester Helps Maintain Reliable DKIM Signing

DKIM signature verification fails when body canonicalization settings don’t match between sender and recipient. MailTester catches this early through bulk verification and inbox testing, helping you avoid delivery issues caused by misconfigured DKIM signatures—especially when strict vs. relaxed body canonicalization creates mismatches in authentication. You don’t need to guess; MailTester shows exactly where things break.

Prevent Delivery Issues Before They Happen

When DKIM is misconfigured, emails get silently rejected or marked as spam—often without any clear signal. MailTester’s bulk list verification filters out addresses that could cause problems, including those linked to fragile or misconfigured domains, reducing the risk of sender reputation damage.

By running deliverability tests before sending, you identify authentication flaws like DKIM failure due to body canonicalization mismatches. These tests simulate how real inbox providers like Gmail and Outlook evaluate your messages. You’ll see exactly where your authentication chain breaks—before your campaign launches and before you face sudden bounces.

Pinpoint Configuration Errors with AI-Powered Analysis

DKIM issues aren’t always obvious. A mismatch in body canonicalization can slip past basic checks, especially if your email client or ESP uses strict body canonicalization while the receiving server expects relaxed. MailTester’s in-app AI assistant can parse raw email headers and highlight the exact line in the signature where canonicalization diverges.

It doesn’t just flag a failure—it helps you understand why. For example, it can spot if whitespace changes, line breaks, or encoding differences in the body caused a mismatch. This level of detail is essential for fixing issues that manual checks often miss. You can see how the body was processed by the sender and how the recipient interpreted it—then adjust your outgoing message setup accordingly.

Unlike some tools that only tell you “this email is invalid,” MailTester reveals the root reason. Whether you’re using SendGrid, Klaviyo, or building your own system, the results are actionable. You can test your current setup with inbox placement tests and iterate until your DKIM signatures pass consistently across providers.

With 98.9% accuracy and credits that never expire, you don’t need to worry about running out of verification attempts. You can keep your list clean, your infrastructure validated, and your authentication reliable—no matter how many campaigns you send or how often your email system changes. This isn’t guessing. It’s precision.

For deeper analysis of how DKIM works end-to-end, refer to the official specification at RFC 6376, which defines canonicalization methods and their impact on signature validity.

Best Practices to Prevent DKIM Verification Failures

Use relaxed body canonicalization in your email settings unless you have a specific need for strict mode. This prevents unnecessary DKIM verification failures caused by minor formatting differences in delivery. Test every template through real delivery simulations, monitor engagement and sender reputation, and follow RFC 6376 guidelines to reduce edge-case issues and keep your domain trusted.

Apply Correct Canonicalization to Avoid Signature Mismatches

  • Set your DKIM signing process to use relaxed body canonicalization unless your organization’s policy or integrator requires strict mode. Strict mode can break DKIM if headers or line breaks shift during delivery — a common occurrence.
  • Verify that your email service provider (ESP) or in-house system follows RFC 6376 Section 3.8 for body canonicalization — the standard specifies how to normalize content before signing and verifying.
  • Don’t assume your ESP handles this correctly by default. Review your configuration, especially when migrating between providers or using automated email tools.

Validate Templates and Infrastructure Proactively

  • Before sending to large lists, run a real inbox placement test on your template to see how it behaves across major providers, including spam filters.
  • Simulate delivery using a test list with known invalid, catch-all, and disposable addresses — tools like MailTester’s bulk verification help identify weak points early.
  • Check sender reputation daily. Tools like Spamhaus or MxToolbox can show if your IP or domain is blacklisted, which often triggers stricter DKIM checks.
  • Monitor engagement metrics (open rates, clicks, bounces) — low engagement increases the chance of your mail being filtered, even if technical checks pass.
DKIM works best when the signing and verification processes align exactly. A single byte change in content due to canonicalization can cause a failure — even if the email is legitimate.

Let’s be clear: no system is immune to delivery quirks. But by standardizing on relaxed body canonicalization, testing rigorously, and keeping infrastructure aligned with RFC 6376, you reduce preventable failures. Use the real-time verification API to check new addresses before sending, and keep your entire email workflow auditable and consistent.

Common Misconceptions About DKIM and Canonicalization

DKIM signature verification failures are often blamed on hacked keys or DNS errors, but a frequent culprit is strict body canonicalization — even minor changes to email content, like formatting or adding a link, can break the signature if the body hash doesn’t match. This isn’t a flaw in your setup; it’s how DKIM is designed.

Body Canonicalization Isn’t Just a Technical Detail

Many assume DKIM works like a simple digital stamp. It doesn’t. The signature relies on a precise hash of the email body, and how that body is processed—before hashing—is determined by the canonicalization method: relaxed or strict. In relaxed mode, whitespace and line breaks are normalized; in strict mode, they’re preserved exactly. A single extra space or line break can invalidate the signature.

Let’s say you send a newsletter through an ESP and later reformat it in the editor. Even a subtle change like adding a <br> tag or restructuring a paragraph alters the body’s byte sequence. If the sender uses strict canonicalization, the original DKIM signature will fail verification — even if the key and DNS are correct.

Third-Party ESPs Aren’t a Blanket Fix

Using a service like SendGrid, Mailchimp, or Amazon SES doesn’t guarantee DKIM works perfectly. These providers do sign emails, but you still need to verify how they apply canonicalization. Some handle it correctly; others may default to strict mode, especially when processing HTML content. If your ESP doesn’t align with the recipient server’s expectations, the DKIM check fails.

It’s not enough to assume the provider has it covered. If you’re seeing consistent DKIM failures, check whether the receiving server uses strict canonicalization and whether your email’s body content matches the signature’s expected hash. The RFC 6376 details this behavior, especially in section 3.3 — it’s the definitive source on how DKIM signatures are validated.

And yes, Outlook and Gmail do not re-sign messages. They verify the original DKIM signature. If the canonicalization step mismatches during processing, the email gets flagged, often as spam or rejected. This is especially common with long, complex HTML emails where small rendering differences lead to big signature mismatches.

Fixing it starts with knowing your email’s canonicalization behavior. Use a tool like inbox placement testing to simulate delivery and catch DKIM validation issues before they hit real inboxes. It doesn’t replace DNS or key checks, but it does show what happens when the body doesn’t match the signature — even when everything else looks correct.

The Bottom Line on DKIM and Body Canonicalization

DKIM verification failures due to strict vs relaxed body canonicalization are not signs of fraud. They are technical mismatches in how email bodies are processed during transit.

Strict body canonicalization can break deliverability when the receiving system expects relaxed mode. Most email infrastructure assumes relaxed processing — enforcing strict mode without coordination disrupts delivery.

Authentication checks must mirror real-world conditions. Use tools like MailTester to test DKIM, SPF, and DMARC in actual inbox environments, avoiding silent failures that harm sender reputation.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does 'DKIM signature not verified' mean?

It means the receiving server could not confirm the email was signed by the claimed domain. This can happen due to incorrect DNS records, body changes, or a canonicalization mismatch.

Why does DKIM fail even with correct DNS records?

Because the email body changed during transit in a way that invalidates the signature. Body canonicalization differences are a common cause.

What is relaxed body canonicalization in DKIM?

A method that normalizes line endings and whitespace in the email body, allowing minor formatting changes without breaking the signature.

When is strict body canonicalization used?

Rarely. It enforces exact byte-level matching and is used only in specific systems where minimal format changes are unacceptable.

Can email templates cause DKIM verification to fail?

Yes. If formatting is modified during template rendering — like extra spaces or line breaks — the signed body may no longer match the delivered version.

How can I test if my DKIM signature is valid?

Use a tool like MailTester’s inbox-placement test to simulate delivery and check DKIM, SPF, and DMARC results in real time.

Does MailTester verify DKIM signatures?

Yes. MailTester's inbox placement and real-time API tests include DKIM verification and detect canonicalization mismatches before send.

Why does my email fail DKIM if SPF and DMARC are correct?

DKIM validates the signature independently. A mismatch in body canonicalization can cause DKIM failure even when SPF and DMARC pass.

Can MailTester help fix DKIM issues?

It can’t fix configuration errors directly, but it identifies issues like signature mismatches and helps you debug them before sending.

Are there tools that simulate real email delivery for DKIM testing?

Yes. MailTester’s inbox-placement testing simulates delivery to real provider servers and reports DKIM verification status.

Is strict body canonicalization ever recommended?

Only in niche environments where all downstream systems are explicitly configured to match byte-for-byte. Most email systems use relaxed mode.

How often should I test DKIM after making changes?

Always test before sending to a large list. Use MailTester’s API or inbox-placement test for continuous validation.