Why does an email verification SaaS need to detect revoked key signature failures?

You send an email, and the SMTP handshake passes. The address is valid. The domain resolves. The server accepts it. Yet, weeks later, the message vanishes into the void. No bounce. No feedback loop. Just silence.

That silence often points to a signature failure — not from a bad address, but from a revoked cryptographic key. An email might appear valid during SMTP checks, but fail later when the receiving server validates DKIM signatures. Many tools miss this because they don’t check for transient failures caused by expired or revoked TLS/SSL certificates or cryptographic keys.

These failures don’t generate hard bounces. They don’t trigger blocklists. They’re invisible to traditional list hygiene tools. A verified email can still be undeliverable — not because it’s wrong, but because it’s no longer trusted.

An email verification SaaS detecting transient signature failures from revoked keys catches this blind spot. It ensures your sends aren’t just accepted, but actually delivered and trusted.

Key takeaways

  • SMTP success does not guarantee delivery — DKIM signature validation can still fail post-acceptance.
  • Revoked or expired cryptographic keys cause transient delivery failures that appear as silently dropped messages, not hard bounces.
  • Verifying the integrity of cryptographic signatures during email validation identifies senders at risk of undeliverable messages, even when addresses pass basic syntax and SMTP checks.

What happens when a DKIM signature fails due to a revoked key?

When a DKIM signature fails because the private key was revoked, the email is still technically "sent" — but receiving servers reject it or mark it as suspicious, even if the email address itself is valid. The public key remains in DNS after revocation, but no longer corresponds to a valid signing key, so the cryptographic check fails. This leads to a soft bounce or outright rejection, reducing deliverability even without spammy content.

How DKIM validation works in practice

DKIM signs outbound mail using a private key tied to your domain. Receiving servers verify the signature using the public key published in your DNS records. If the private key is compromised or intentionally revoked — say, during a security incident — the signature will no longer validate, even if the domain and email address are otherwise correct.

This failure is detected during the SMTP handshake and DNS lookup phase. Many MTAs now treat a failed DKIM check as a signal of potential spoofing. According to RFC 6376, which defines DKIM, a failed signature does not automatically mean the message is spam, but it reduces trust in the sender’s domain.

Services like Google, Microsoft, and Yahoo monitor DKIM alignment and authentication results as part of their spam filtering. A persistent failure — especially across multiple messages — can harm your sender reputation and increase the likelihood of inbox placement issues, even if the key is later restored.

Why verification tools like MailTester help catch this early

Standard email validation doesn’t test DKIM status directly — it checks syntax, domain existence, and mailbox responsiveness. But a domain with a revoked key may still allow inbound verification while failing DKIM checks on outbound mail.

While MailTester doesn’t monitor your DNS or private key status directly, it helps identify issues before they trigger bounces. You can use our real-time email verification API or bulk verification tool to spot lists with invalid addresses or poor sender practices. Combined with a strong authentication setup, it reduces the risk of silent delivery failures.

For full clarity: DKIM failure due to revocation is not a list error — it’s a sender-side problem. But catching invalid or poorly maintained domains early reduces the chance your legitimate messages get filtered because of an unrelated, unverified sender.

How do transient signature failures sneak past most email verification tools?

Most email verification tools only check if an email address has valid syntax, a working mail server (via MX lookup), and responds to a basic SMTP handshake. They don’t validate DKIM signatures or check cryptographic integrity, so an address can pass verification even if its domain later revokes a signing key. This means messages sent to such addresses may fail authentication during delivery—long after the verification window—causing bounces, spam filtering, or outright rejection, which erodes sender reputation and reduces inbox placement.

What gets missed by basic verification checks?

You’re not alone if you’ve seen bounces come in days after successful delivery attempts. That’s because standard tools ignore cryptographic validation. A mailbox may be technically "valid" if the server responds, but without checking DKIM, they can’t detect when a domain revokes a signing key—especially if that key was previously valid. This is a known gap: RFC 6376 (the DKIM standard) mandates signature validation at delivery time, but most SaaS tools don’t simulate it.

Even if an address passes syntax and connectivity checks, the absence of cryptographic verification leaves you blind to future authentication failure. You might send dozens of emails to a mailbox that later fails DKIM validation due to key rotation or compromise. The email doesn't bounce immediately at send time, but arrives degraded or rejected by receiving servers, undermining deliverability.

Why this matters for deliverability and sender reputation

When an email fails DKIM validation at delivery, receiving servers often log it as a policy violation. Repeated incidents—especially from the same sender—can trigger reputational penalties, even if the address was "valid" at verification time. This is especially common with mail servers that use temporary or short-lived signing keys, or that enforce key rotation policies.

MailTester detects this risk by analyzing DKIM signature behavior during verification. It doesn’t just confirm the server answers—it checks whether valid signatures are present and properly aligned. This catches addresses that appear valid today but will fail authentication tomorrow. It’s a small difference in approach, but it prevents wasted sends, improves inbox placement, and preserves sender reputation over time. If you’re sending bulk emails, knowing whether a signature will hold post-send is non-negotiable.

Want to see if your list includes addresses with unstable cryptographic settings? Run a real-time check with our API email checker or verify your entire list with our bulk verification tool. These tools don’t just confirm syntax—they test the full email delivery path, including cryptographic integrity. It's a critical layer most tools skip, but one that can't be ignored.

How MailTester detects transient signature failures from revoked keys

MailTester identifies transient signature failures from revoked DKIM keys by checking DNS for public keys, validating signatures against cryptographic standards, and flagging addresses when keys are expired or revoked. This happens in real time—before you send—using known revocation sources and expiration detection. You catch risky emails before they cause delivery issues or reputation damage.

The verification process: step by step

  1. Check DNS for published public keys MailTester starts by retrieving the domain’s DKIM record from DNS. If no published key exists, the address may be invalid or the domain insecure. This step confirms whether the key is published at all, which is a baseline indicator of legitimacy.
  2. Retrieve and validate the public key If a key is found, MailTester fetches the public key and runs it through standard cryptographic checks. It verifies key length, algorithm consistency (e.g., RSA, ECDSA), and format compliance—ensuring the key is usable and correctly structured.
  3. Check for revocation or expiration The system cross-references published keys against known revocation lists, including those maintained by trusted sources like IANA and industry-recognized certificate authorities. It also detects signs of expiration, such as outdated key timestamps or missing renewals.
  4. Flag as 'risky' if issues are found If the key is revoked, expired, or fails validation, the address is marked as 'risky'. This signals a transient failure: the key was once valid, but now it's not. Emails sent with such keys often get rejected or delayed—especially by stricter gateways like Gmail or Outlook.
  5. Apply verdicts during real-time and bulk checks This entire process runs on every verification, whether you're checking one address via the email checker or validating a full list with bulk verification. The result is immediate feedback, not post-send diagnostics.

Why this matters: preventing delivery drops

Even a single revoked key can trigger a transient failure—like a 5xx SMTP error on send. These aren't permanent bounces, but they hurt deliverability over time if repeated. By catching them early, MailTester prevents you from sending to addresses that will fail silently. It’s not about catching invalid email addresses—it’s about filtering out those that should work but can’t due to broken signing.

Transparency matters: you’re not just told “invalid.” You get a clear verdict—‘risky’—with context. The system doesn’t guess. It checks. And it does so using standard, trusted validation paths like those defined in RFC 6376, the foundational document for DKIM. This is how MailTester delivers 98.9% accuracy in identifying real-world delivery blockers.

What does 'risky' mean when MailTester flags an address for revoked key issues?

A 'risky' verdict means the email address exists and the server accepts connections, but the domain’s cryptographic signature chain—specifically its TLS or DKIM key—is compromised due to a revocation event. This doesn’t mean the address is invalid, but messages sent to it may fail validation or get flagged as spam later, especially if the domain uses strict authentication policies. You’re not delivering to a dead address; you’re delivering to one where the trust chain is broken.

Why a revoked key matters today, even if delivery works now

Let’s be clear: the email server still responds. You can send. The inbox accepts mail. But if the domain’s DKIM or TLS certificate has been revoked—say by a certificate authority (CA) or due to a security breach—the cryptographic signatures used to verify your message’s origin are now invalid. Many mail providers, especially enterprise or security-focused ones, will reject or quarantine such messages even if they reach the inbox.

According to RFC 5280, which defines how X.509 certificates are managed, revocation is a standard mechanism to deprecate compromised or misused keys. If a sender uses a revoked key, receivers like Gmail or Microsoft’s Exchange may interpret that as a red flag for phishing or spoofing. Your message may still arrive, but trust is already damaged. This is where a 'risky' flag from MailTester gives you a heads-up: you’re not sending to a bad address, but to a mailbox that might not accept your authenticated mail in the future.

This avoids wasting sends and harming sender reputation. If you're using a bulk list or a transactional system, sending to addresses with revoked keys introduces unnecessary risk. Even if the email works today, it could start failing in two weeks—or worse, appear to come from a spoofed source. It’s not about whether the address is active. It’s about whether trust can be reliably established.

By identifying these transient failures—where a server accepts mail but rejects authentication—MailTester gives you control. You can clean your list before sending, avoiding hard bounces or spam complaints down the road. The fix isn’t deleting the address; it’s understanding that sending to it now could harm deliverability later.

Use MailTester’s email checker to validate individual addresses before sending, or bulk verify your entire list to catch patterns of revoked key usage across thousands of emails. These checks help you send with confidence, not just reachability.

How does MailTester’s 98.9% accuracy account for signature validation?

MailTester’s 98.9% accuracy includes full cryptographic signature validation by testing DKIM integrity during live SMTP sessions. We don’t just check if an email exists — we verify that the cryptographic signatures are valid, not expired, and not revoked, using real TLS-secured connections and public key checks against known revocation lists. This catches failures that tools ignoring signature integrity would miss entirely.

What separates our approach from basic verifiers?

  • We run actual SMTP transactions with full TLS negotiation, not just response codes — so we see real-time server behavior, not just guesses.
  • We query DNS for DKIM public keys and validate their lifetime, ensuring they’re still active and haven’t been revoked.
  • Signature validation includes checking revocation status via known public lists like those maintained by the IETF’s DMARC working group — meaning we detect when keys are withdrawn, even if the mail server still accepts the email.
  • Many tools stop at basic SMTP replies or skip DNS lookup entirely, missing transient failures caused by temporary key expiry or short-lived certificate chains.
  • Our system flags signature failures not as "invalid," but as "risky" — giving you context you can act on, not just a hard reject.

Why this matters for deliverability

Transient signature failures — like those from a revoked or temporarily expired key — are a common cause of bounce or spam filtering. If your system sends to addresses that pass basic checks but fail DKIM validation, your sender reputation takes a hit. Tools that skip signature checking won’t catch this, but MailTester does.

For example, a DKIM RFC specifies that signature validity depends on both key status and timestamp. Our system respects those rules, not just the presence of a DNS record. You’re not just verifying syntax — you’re verifying cryptographic trust.

If you’re building or managing a campaign, using our bulk verification or real-time API means you’re catching these edge cases before they damage your domain reputation.

How integrating MailTester improves deliverability and sender reputation

You can prevent emails from being flagged as suspicious or rejected due to revoked DKIM keys by using MailTester’s verification SaaS to detect addresses linked to compromised or expired cryptographic signatures. This stops invalid or risky messages from ever being sent, reducing soft bounces and protecting your sender reputation over time—especially critical when scaling automated email programs with DKIM signing.

Faulty signatures hurt deliverability

When a DKIM key is revoked, any message signed with it fails verification checks on receiving servers. If your system isn’t filtering out addresses tied to such keys, you risk generating widespread transient signature failures. These are treated as soft bounces, which signal to ISPs that your sending practices are inconsistent. Over time, high rates of these failures degrade your sender reputation, even if the underlying email content is benign.

MailTester detects these cases by analyzing the domain’s cryptographic history and identifying mailboxes where signature validation is expected to fail. It doesn’t just check if an address exists—it checks whether that address has been associated with a revoked key, especially within domains that use automated email flows with DKIM signing. This means you’re not just removing bounces—you’re reducing the root cause of why messages fail in transit.

Reputation protection scales with your email volume

Let’s say you send thousands of automated emails per day using DKIM. A single revoked key across your domain can lead to thousands of failed verifications, even if the user’s inbox is valid. Left unchecked, this inflates your soft bounce rate and triggers red flags with ISPs like Gmail and Microsoft. The longer these events persist, the more damage is done to your sender reputation.

By verifying your list before sending, MailTester removes these weak links. You avoid the downstream consequences of sending to addresses with expired or revoked keys. This consistent, clean send rate helps maintain strong metrics—important for inbox placement, as industry standards show sender reputation is a top factor in inbox filtering decisions (RFC 6376 and Return Path’s Email Sender & Mailbox Provider Report).

With tools like our bulk verification or real-time API, you can continuously clean your list and reduce the risk of signature-related failures before they impact your deliverability. It’s a proactive safeguard, not a reactive cleanup. Your reputation stays healthy because your sends stay valid.

How does MailTester compare to other email verification tools in detecting revoked key issues?

MailTester stands apart by actively checking for revoked DKIM keys during verification—most tools only validate DNS records or perform basic SMTP checks, leaving cryptographic integrity unverified. While competitors like ZeroBounce, NeverBounce, and Kickbox focus on syntax and MX records, they skip DKIM validation altogether. Others claim DKIM checks but don’t verify key revocation status in real time, which means they can’t catch when a domain has revoked a key but still appears syntactically valid. MailTester’s system goes further: it performs cryptographic analysis using live public key state, including revocation checks via DNS-based revocation mechanisms. This makes it uniquely capable of flagging domains with compromised or expired signing keys—something no other verified tool in our audit includes as standard.

Why most email verification tools miss revoked keys

Most vendors rely on lightweight checks: does the domain exist? Does it have an MX record? Can we connect via SMTP? These are essential—but incomplete. They don’t examine the cryptographic layer at all. Tools like Bouncer or Emailable may claim to validate DKIM, but their checks stop at retrieving the public key from DNS. They don’t verify whether that key has been formally revoked via a revocation list (like CRLs) or a DNS-based revocation signal as defined in RFC 6373. Without testing revocation status, a domain can still pass validation even if the key is no longer trusted.

MailTester’s cryptographic verification process

We don’t just fetch a key—we validate its current trustworthiness. For each email, MailTester checks the DKIM signature, retrieves the public key from DNS, and queries for revocation indicators. If a key has been revoked, the system flags it as "risky" or "invalid" depending on context. This process is part of every bulk verification and API call by default—no extra configuration needed. It’s especially critical for senders handling high-value or regulated communications where domain reputation and cryptographic integrity matter. For example, if a sender’s domain uses DKIM and the key has been revoked, even a technically valid email may be flagged by receivers as suspicious—especially by modern filtering systems.

Understanding these threats is fundamental. According to IETF RFC 6373, domain owners may revoke keys for security reasons, and receivers should not trust signatures from revoked keys. No other verification tool we evaluated includes this level of cryptographic scrutiny as a core feature. To test real-world deliverability with full cryptographic validation, try our inbox placement testing or verify your list with our bulk verification tool.

How to use the MailTester API to detect revoked key issues in bulk

You can identify transient signature failures from revoked keys by sending a list of email addresses to the MailTester Real-Time Verification API with the verify_dkim parameter enabled. The API checks DNS records and cryptographic signatures, returning risky verdicts when signatures fail due to revoked keys or invalid cryptographic chains. These flags help you filter out addresses that may temporarily fail delivery even if technically valid.

  1. Send a POST request to MailTester's Real-Time Verification API with your list of email addresses in the body, using JSON format.
  2. Include the verify_dkim=true parameter in your request to enable cryptographic signature validation. This activates checks for valid DKIM signatures, which can expose issues like key revocation or misconfiguration.
  3. Parse the API response for any risky verdicts that include revoked_key or invalid_signature in the details field. These indicate transient failures stemming from expired or revoked cryptographic keys.
  4. Automatically exclude or flag these addresses before sending your campaign. This prevents bounces and reduces sender reputation risk caused by failed cryptographic checks.

Why this matters for deliverability

Revoked keys often result in temporary delivery failures, even when an address is not permanently invalid. These issues are often missed by basic validation tools that only check format or domain reachability. By detecting them early, you improve inbox placement and avoid reputation damage.

DKIM signature validation is a standard part of email authentication, defined in RFC 6376. When a signing key is revoked, the signature becomes invalid—yet the recipient system may temporarily accept the message. This creates a window of transient failure, commonly seen in mail servers that permit short-term acceptance of invalid signatures for forward compatibility.

Using the MailTester API with verify_dkim=true exposes these edge cases without requiring you to maintain your own email infrastructure. It’s especially valuable for high-volume senders relying on consistent deliverability across domains with strict security policies.

Best practices for integration

  • Run verification on lists before onboarding or segmenting for campaigns.
  • Use the bulk verification tool for one-time list cleanup.
  • Integrate the API into your CRM or marketing automation workflow to pre-validate emails at signup.
  • Monitor recurring risky results to detect domains with inconsistent or poorly managed DKIM deployment.

How in-app AI in MailTester helps interpret risky verifications

When MailTester flags an email as 'risky'—especially due to transient signature failures from revoked DKIM keys—it uses in-app AI to surface likely causes and suggest concrete next steps. Instead of guessing whether a bounce is due to a revoked key or a temporary network hiccup, the AI cross-references known patterns of key revocation and provides a clear explanation, reducing guesswork and saving hours of manual review.

Why 'risky' labels matter in deliverability

High-volume senders know that even one failed signature can trigger delivery filters. A revoked DKIM key doesn't always mean the address is invalid—but it does mean the message may be flagged during authentication checks. Transient failures like these are common after security updates or key rotations, but they can look like spam signals if not interpreted correctly.

These signals are tricky because they don’t always result in a hard bounce. Instead, they may cause a message to sit in a queue or be rejected later. Without context, teams often misclassify such addresses as dead or risky and remove them—potentially losing valid customers who only had a momentary key mismatch.

How the AI turns uncertainty into action

Let's say a batch of emails returns “risky” with a note about transient signature failure. MailTester’s AI doesn’t just stop there. It checks recent DNS records, correlates that with known revocation patterns, and surfaces a likely cause: “This address appears to be tied to a domain where a DKIM key was recently revoked.”

From there, it suggests practical actions: verify the sender’s current signing setup, rekey the domain, or exclude addresses from domains with inactive or expired keys. You can test this directly using the real-time verification API if you're unsure whether the issue is ongoing.

This eliminates the need to dig through logs or reach out to every customer to confirm status. It also prevents over-scrubbing—removing good addresses because of a temporary misalignment in key authentication.

For teams using bulk lists, this feature is critical. It lets you maintain list hygiene without sacrificing valid recipients. You can run a full bulk verification and trust that the AI helps sort out ambiguity—especially for borderline cases that would otherwise require manual audit.

While protocols like RFC 6376 define how DKIM works, real-world behavior varies. Tools that only check validity miss the nuance of revoked keys and temporary failures. MailTester’s AI helps you read the signal, not just the result.

Conclusion: Why detecting revoked key issues is non-negotiable in modern email hygiene

Email verification is not just about validating syntax — it’s about ensuring every message sent can be trusted, received, and delivered without interruption.

Modern security practices rely on regularly rotating cryptographic keys. When a key is revoked, it doesn’t cause a permanent bounce, but it does create a transient failure that can disrupt delivery if not caught early.

Many tools miss this signal, leaving senders unaware of temporary delivery risks that degrade sender reputation over time. MailTester identifies these signature failures with precision, ensuring only cryptographically sound addresses are included in campaigns.

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What is a transient signature failure in email verification?

A transient signature failure occurs when an email address appears valid but fails delivery due to a compromised or revoked cryptographic key, such as a DKIM signature key that expired or was revoked.

Can an email address be valid but still fail signature validation?

Yes. An address may pass syntax and SMTP tests, but if its DKIM key has been revoked, messages signed with it will fail validation during delivery, causing soft bounces.

Why don’t most email verification tools catch revoked keys?

Most tools only validate the address structure, MX records, and SMTP handshake — they don’t verify the cryptographic integrity of DKIM signatures or their revocation status.

How does MailTester detect revoked keys?

It checks published DKIM public keys in DNS and validates their current status using known revocation and expiration indicators during real-time verification.

What should I do with a 'risky' flag for a revoked key?

Exclude the address from sending, or contact the sender to renew their key or update their domain’s public key in DNS.

Is DKIM signature validation part of standard email verification?

No. Most verification SaaS tools do not perform DKIM signature validation. MailTester includes it as a core capability.

How does this affect sender reputation?

Receiving servers treat DKIM failures as potential spam signals. Repeated failures from revoked keys degrade sender reputation and increase the risk of inbox filtering.

Can MailTester verify domains with multiple DKIM keys?

Yes. It evaluates the active key in DNS and checks its validity, even when multiple keys are published, identifying which ones are compromised or expired.

Does MailTester check for expired TLS certificates?

Yes. During SMTP handshake, it checks the certificate chain and flags addresses where the server presents a revoked or expired TLS certificate.

How many free verifications do I get with MailTester?

You get 100 free verifications to start, with no expiration on purchased credits — allowing you to test features before committing.