Why is your DKIM signature failing with RSA-SHA256 hash invalid?

You sent a message. The DKIM signature says it’s clean. But the recipient’s system rejects it with “RSA-SHA256 hash invalid.” You didn’t change anything. Your domain still looks legit. So why is your email getting blocked?

Because somewhere, the cryptographic math doesn’t add up. The signature fails not because the server is hostile, but because the public key in DNS doesn’t match the private key used to sign your email. Even a single wrong character—like an extra space, incorrect line break, or misencoded header—can break validation.

DKIM isn’t a fluke. It’s a cryptographic handshake. If the keys don’t align at the byte level, the signature fails. This error is common after domain migrations, DNS changes, or when using automated tools that don’t respect formatting rules.

Key takeaways

  • A DKIM "RSA-SHA256 hash invalid" error indicates a cryptographic mismatch between the DNS public key and the signature generated by the sending server.
  • Even minor formatting issues like incorrect line breaks or encoding in the DNS TXT record can prevent successful verification.
  • When using domain-level DKIM, always verify that the private key used to sign messages matches the public key published in DNS—down to the character.

What exactly does 'RSA-SHA256 hash invalid' mean in practice?

When a receiving mail server checks your DKIM signature, it retrieves your public key from DNS and uses it to verify the hash of your signed email content. If the computed hash doesn’t match the one in the signature, the validation fails—this is what "RSA-SHA256 hash invalid" means. It’s almost always due to a mismatched or misconfigured key, not a problem with your email client or network.

The role of hashing in DKIM validation

DKIM signs an email by generating a cryptographic hash of selected headers and the message body using the SHA-256 algorithm. This hash is then encrypted with your private key. The receiving server performs the same hash calculation on the same parts of the email and decrypts your signature using your public key from DNS. If the results don’t match, the signature is invalid.

It’s crucial to understand that the 'RSA-SHA256' designation means two things: the key type (RSA) and the hashing algorithm (SHA-256). Any change to either side—like using a different algorithm, a malformed key, or an incorrect key in DNS—will break the match. The error does not mean your email was lost or corrupted; it means the cryptographic proof failed.

Common causes of a mismatched hash

Most often, this error happens because the public key in DNS doesn’t align with the private key used to sign the message. For example, if you regenerated a DKIM key but forgot to update the DNS record, the server will still use the old public key and fail to validate. Similarly, if the key is incorrectly formatted—extra spaces, line breaks, or base64 encoding errors—the hash won’t match.

Headers included in the signature can also cause mismatches. If the email’s headers are modified en route (e.g., by a relay or forwarding service), even one extra space or changed line ending will invalidate the hash. Tools like MailTester’s bulk verification can help you catch invalid signatures before sending large campaigns.

For deeper troubleshooting, consult the DKIM specification in RFC 6376, which defines the standard for message signing. It’s the definitive reference for how signature validation should work. While some email providers offer tools to test DKIM, you’ll need to inspect the full email and compare the signed content against what’s in DNS. The mismatch is never between the client and server—it’s between the signing process and the public key.

How to verify the correctness of your DKIM public key in DNS

You can fix a DKIM signature error with an invalid rsa-sha256 hash by confirming your DNS TXT record matches the key your email system uses. Check the selector, spacing, key length, and Base64 encoding. Use tools like MxToolbox or DNS Survey to fetch the record and validate it directly.

Check your DNS TXT record

  • Use a DNS lookup tool like MxToolbox or the dig command to fetch your domain's DKIM TXT record.
  • Ensure the record is a single line with no line breaks or extra whitespace—common issues are invisible spaces or wrapped lines that break the parsing.

Validate key and selector

  • Confirm the selector (e.g., default, s1, selector1) in your DNS record exactly matches the one set in your email service (SendGrid, Amazon SES, etc.). A mismatch breaks DKIM authentication.
  • Verify the key is 2048 bits if your system expects that size. The key must be encoded in Base64 and wrapped only in the official format: pk= followed by the raw key data.
  • Compare the full key in DNS against the key you generated during DKIM setup. Any difference—extra space, removed character, wrong encoding—will result in a hash mismatch.
  • Use the DKIM specification (RFC 6376) to verify the expected format: v=DKIM1; k=rsa; p=... where p= contains the Base64-encoded public key.

After fixing DNS issues, test delivery with a real email. You can use MailTester’s inbox placement tool to see if your DKIM signature is now accepted by major providers. Always double-check before sending campaigns.

Step-by-step: How to fix RSA-SHA256 DKIM signature issues in your domain settings

When your DKIM signature shows an RSA-SHA256 hash invalid error, it usually means your public key isn’t properly published in DNS or the key pair is mismatched. You must regenerate the DKIM key pair in your email service, update the DNS TXT record exactly, and verify the full chain using a tool that checks both DNS and actual email delivery. After DNS propagation, test again with a fresh message.

  1. Log in to your mail service provider – Access your email platform’s settings (SendGrid, Amazon SES, or your hosting control panel). The DKIM settings are typically under domain authentication or email security.
  2. Verify the active selector and key status – Check if the current selector is active and the key is valid. If the key is expired, revoked, or shows as failed, you must regenerate it. Never reuse old keys; each key pair should be fresh and unique.
  3. Regenerate the DKIM key pair – Initiate the key regeneration process. Ensure it uses rsa-sha256 as the signing algorithm, which is now required for modern email systems. Keys generated with older algorithms like rsa-sha1 will fail validation.
  4. Copy and paste the new public key exactly – The public key must be copied in full, including all characters, quotes, and line breaks. Paste it directly into the DNS TXT record field without editing. Even a single missing character breaks the chain. RFC 6376 specifies the exact syntax for TXT records.
  5. Validate the full DKIM chain using a real-world test – Use MailTester’s bulk verification tool to check hundreds of addresses and confirm their DKIM alignment. It tests both DNS records and inbound delivery, revealing misconfigurations before they cause bounces or spam filtering.
  6. Wait for DNS propagation and retry – DNS changes take 5 to 15 minutes to propagate globally. After waiting, send a test email from your domain and recheck the DKIM signature. Use the inbox placement tester to verify your email reaches inboxes reliably.

Why the details matter

DKIM relies on perfect cryptographic alignment. A single typo in a TXT record breaks the signature. Even minor issues — like extra spaces around the key or misencoded characters — can trigger "hash invalid" errors. The sender’s private key must match the public key in DNS. Using a tool that validates the full delivery path helps you catch problems invisible in DNS checks alone.

When in doubt, reset and verify

If you're unsure whether your key is valid, regenerate it and double-check the DNS entry with a tool like MXToolbox or DMARCian. These tools confirm both record syntax and live DNS resolution. Never assume a record is correct just because it was copied. Test, wait, and retest.

Key alignment: Why selector and signature must match

DKIM fails when the selector in your email's signature doesn't match the DNS TXT record name. The 's=' tag in the DKIM-Signature header must exactly match the name of the DNS record (like selector._domainkey.yourdomain.com). A single typo or missing period breaks validation.

How the selector flow works

Your email client signs the message using a specific selector—say, mail—which gets embedded in the DKIM-Signature header as s=mail. The receiving server then looks up the public key at mail._domainkey.yourdomain.com. If the DNS record name mismatches the selector, the key won't be found, and the signature is rejected.

Common mismatches include: sel1 vs s1, forgetting the period between mail._domainkey, or using a subdomain like mail._domainkey.dev.yourdomain.com without adjusting the selector accordingly. Even capitalization differences—like S1 vs s1—break the alignment.

Double-check every layer of the stack

Let’s walk through the chain. In the email header, you’ll see a line like DKIM-Signature: v=1; a=rsa-sha256; d=yourdomain.com; s=mail;. Now, verify that your DNS TXT record is exactly named mail._domainkey.yourdomain.com. Use MXToolbox’s DKIM lookup to check this in real time.

If you're using a third-party sender (like Mailchimp or SendGrid), you might not control the selector. Confirm the value they're using matches the record you've published. Misalignment here is a top cause of DKIM failures, especially during migrations or API migrations.

Always verify that the selector is consistent across the header, the signature, and the DNS record. This consistency is not optional—it’s fundamental to the verification process defined in RFC 6376. A single mismatch breaks trust at the protocol level.

If you're unsure, check a single address with MailTester to validate your entire setup—including DKIM alignment—before sending to your full list.

What to do when your email provider reports DKIM failure

If your email provider flags a DKIM signature error with "rsa-sha256 hash invalid," start by verifying the DKIM signature generation in your email system. Check that the public key is correctly published in DNS, ensure the signing domain matches the from address, and confirm no intermediary service is altering the headers. Use a real-time verification tool to test the exact message being delivered, including the full header set.

Diagnose the root cause with precision

  • Look in your email provider’s delivery logs for the exact error message. "Signature verification failed" or "hash mismatch" confirms DKIM is failing during validation.
  • Review any automated email filters, mail gateways, or content sanitizers that might remove or alter headers. Even minor modifications can invalidate a DKIM signature.
  • Check third-party integrations like Zapier, HubSpot, or SendGrid if they handle outbound mail. These services sometimes rewrite headers or add content, breaking DKIM.
  • Test with a known-good message using the same domain and sending path. If the error persists, the issue is likely in DNS, domain configuration, or email server setup.

Verify DKIM integrity in real time

Let’s be honest: even with correct DNS records, a single misconfigured header during delivery can cause failure. Use a tool like MailTester’s email checker to send a test message and inspect the raw DKIM signature. This reveals whether the signature is malformed or altered during routing.

DKIM relies on cryptographic standards defined in RFC 6376. If the signature uses rsa-sha256 but the hash doesn't match the signed content, the receiving server rejects it. This can happen due to case sensitivity, missing or extra whitespace in the header, or encoding issues in the signature line.

If you’re sending through an ESP, confirm they’re not applying additional signing or content rewriting. Some platforms re-sign messages, which can invalidate or misalign the original DKIM signature. You can use MailTester’s inbox placement test to see if the message reaches the inbox or is marked as spam due to signature issues.

Finally, validate your public key is published correctly in DNS with a TXT record. A typo, missing space, or incorrect selector can cause the receiving server to fail the lookup. Use a public DNS tool like MXToolbox to verify the record resolves properly and matches your private key’s signature.

How MailTester helps catch DKIM signature errors before they impact deliverability

You can catch RSA-SHA256 DKIM signature errors—like invalid hashes or misaligned keys—before they break deliverability by testing real message headers with MailTester’s inbox-placement tool. It checks the full cryptographic chain, including the signature’s hash value against the public DNS key, flagging mismatches with clear error codes. This stops bounces and spam filtering before they happen.

Full header analysis detects cryptographic misconfigurations

DKIM signatures rely on precise alignment between the signed content and the public key recorded in DNS. Even a small mismatch in the hash—say, due to whitespace or encoding changes—breaks validation. MailTester’s inbox-placement testing analyzes the complete message headers, including the DKIM-Signature field, to verify that the RSA-SHA256 hash matches what the public key expects. This is the same validation used by major inboxes like Gmail and Outlook.

Real-time API lets you test before sending

Let’s say you’re building a campaign with dynamic content or automated workflows. You can integrate MailTester’s real-time API to check individual messages against the full DKIM signature and DNS record during development. If the hash is invalid, the API returns a precise error code—like dkim_hash_mismatch—so you can fix the issue before sending to real users. This is especially useful when modifying templates or adding signatures manually.

Most email providers enforce DKIM validation aggressively. An invalid signature, even if the domain is otherwise valid, can trigger rejection by providers like Microsoft or Google. According to RFC 6376, DKIM verification is mandatory for inbound mail processing—meaning no exception, no soft fail.

With 100 free credits, you can test your current list or campaign setup without commitment. Use the inbox placement tester to send a sample message through real inbox paths and see exactly where DKIM fails. If you're managing large lists, the bulk verification tool processes thousands of addresses and flags signature errors at scale.

For teams embedding verification in their delivery pipeline, the API integrates directly into workflows, catching misconfigurations before they hit customers. No more guessing. No more delivery drops. Just clear, actionable feedback on signature validity.

Why even small changes to your email system can break DKIM

Even a minor update—like renewing your TLS certificate or switching an SMTP relay—can break DKIM if the private key isn’t preserved exactly as it was. DKIM relies on the consistency of cryptographic keys; change anything in the signing path without updating DNS, and your signature fails validation. This breaks authentication, directly harming your sender reputation and inbox placement.

Key moments when DKIM breaks silently

Let’s say you migrate from one email platform to another—Mailchimp, Klaviyo, SendGrid, or a custom setup. Each system uses its own signing keys. If you don’t generate a new DKIM key in the new environment and publish it to DNS, your outgoing messages lose valid authentication, even if everything else appears correct.

Updating your TLS certificate? That’s a routine security move. But if the update forces a re-encryption of your email server’s private key and that key is used in DKIM signing, the signature becomes invalid. No warning. Just a failed signature in your email logs. You might not notice until you're in the bounce queue or blocked by a major inbox provider.

Even third-party tools that manage your sends—like Klaviyo or HubSpot—don’t always auto-replicate DKIM keys after configuration changes. You may re-enable a campaign, change a template, or adjust sending settings, and suddenly your DKIM signature fails because the system re-uses an old or invalid key. The tool won’t alert you unless you’re watching DNS records closely.

Why a broken DKIM signature hurts your deliverability

A failed DKIM check is treated like a red flag by inbox providers. RFC 6376 (the official DKIM standard) defines this as a strict validation failure—it means the message was altered or never signed correctly. Even one failure in a batch can drop your overall reputation score.

Services like Google and Apple use DMARC policies to enforce authentication. If DKIM fails and DMARC is set to "reject" or "quarantine" (which many domains now are), your message hits the spam folder—or worse, gets rejected outright. This isn’t rare. A 2021 study by Return Path found that non-compliant messages had a 40% lower inbox placement.

Fixing a "rsa-sha256 hash invalid" error isn’t always about changing the algorithm. It’s about tracing back where the signature was generated and ensuring the private key matches what’s published in DNS. If the system changed, you may need to regenerate the key, update your TXT record, and confirm the change using a tool like inbox placement testing.

Before sending to a new list, verify all domains and keys with a tool like bulk email verification. It can catch invalid or misconfigured DKIM at scale, before you lose reputation. That’s how you stay ahead of silent failures.

Never assume a change is safe just because it’s small. In email authentication, small changes carry large consequences.

Common sources of DKIM signature failure beyond incorrect keys

You don’t always need to regenerate your DKIM keys when seeing a "rsa-sha256 hash invalid" error. Message rewriting by platforms like Google Workspace or Microsoft 365 can reorder headers or alter content, breaking the signature’s hash alignment. Even correct keys fail if SPF and DKIM don’t align under DMARC. Subdomain shifts, mixed domains in campaigns, or malformed MIME structures can also trigger invalid signatures. Let's break down what’s actually going wrong.

Content rewriting by email gateways

  • Google Workspace and Microsoft 365 often add or reorder headers (like Received or DKIM-Signature) during processing, which changes the canonicalized header order and invalidates the DKIM hash.
  • Some providers strip whitespace, normalize line endings, or inject tracking parameters, altering the body hash even when the key is correct.
  • Check if your outgoing mail service appends headers or modifies content before sending—this is a common source of mismatched signatures.

Alignment and encoding issues

  • DKIM alignment must match SPF alignment for DMARC to pass. If one fails, the other can’t save you. Use DMARC’s alignment definition to audit your setup.
  • Changing domains or using subdomains without proper DNS configuration breaks alignment. For example, sending from [email protected] to yourcompany.com fails unless both match the domain in the From header.
  • Improper HTML or MIME encoding (e.g., incorrect line breaks in multipart emails, malformed Base64) directly alters the body hash. Use a tool like inbox placement test to simulate real delivery and catch these issues.
  • Always canonicalize headers and body content exactly as specified in the DKIM RFC (specifically RFC 6376) before signing.
Even with correct keys, a single whitespace difference in the body or header order can invalidate a DKIM signature.

Prevention and validation

  • Test with a real delivery simulator that mimics third-party gateway behavior, not just local signing tools.
  • Verify your DKIM signature against actual delivered mail using a tool like MailTester’s email checker to validate both the technical signature and alignment.
  • Run domain checks with bulk verification if testing at scale to detect recurring alignment or formatting failures.

Final verification: How to confirm DKIM is working correctly

You can confirm your DKIM signature error is fixed by sending a test email to a personal inbox, checking the full headers for a valid DKIM-Signature header with a properly Base64-encoded 'b=' field, validating the public key in your DNS TXT record matches the one used to sign, and verifying delivery success over time with inbox placement tests and bounce reports.

  1. Send a test email from your verified domain to a personal email address. Use a real address like your own Gmail or Outlook account. This ensures you can inspect the full email headers later and test real-world deliverability.
  2. View the full headers of the received email. In Gmail, click the three-dot menu on the message and select "Show original." In Outlook, go to File > Save As > "Message Format" as "Text" or use the "View Source" option.
  3. Locate the DKIM-Signature header. Look for a line starting with DKIM-Signature:. It should include v=DKIM1;, k=rsa;, and p= with a public key in the DNS record.
  4. Verify the 'b=' field is a valid Base64-encoded signature. The value after b= should be a single, continuous string with no line breaks. It must decode to a binary signature that matches the public key. Any non-Base64 characters or line breaks indicate a flawed signature.
  5. Confirm the public key in your TXT record matches the one in the signature. Copy the p= value from the DKIM-Signature header and check it against your DNS TXT record. The key must match exactly, including spacing and formatting — even a single missing space invalidates verification. Use tools like MXToolbox to validate DNS records.
  6. Test the full signature integrity with a public DKIM validator. Use a tool like DMARC Analyzer’s DKIM Checker to paste the full header and confirm the signature is validated by the public key.
  7. Run an inbox placement test. Use MailTester’s inbox placement test to send a message to multiple major inboxes (Gmail, Yahoo, Outlook) and see if DKIM passes validation and the email arrives in the primary inbox.
  8. Monitor bounce reports and delivery logs over time. Check your sender domain’s reputation and delivery rates with tools like Postmark’s Deliverability Guide or built-in ESP reporting. Sustained delivery success means DKIM is functional and trusted.

Why consistency matters

Even if one test passes, repeated failures or low inbox placement suggest underlying issues. DKIM must remain valid across all sends. Use MailTester’s bulk verification to check your list for invalid or poorly formatted domains that might trigger signature issues at scale.

Common pitfalls

  • Using multiple DKIM keys without aligning them with your SPF and DMARC policies.
  • Altering the signature before it reaches the recipient (e.g., via third-party email gateways).
  • Having mismatched public keys in DNS and the email headers.
  • Allowing email providers to rewrite or append headers, breaking DKIM alignment.

Keep your DKIM secure, consistent, and always working

DKIM signatures must be valid and correctly configured to maintain trust with receiving mail servers. Even a minor misconfiguration—like an RSA-SHA256 hash mismatch—can break authentication and hurt deliverability.

Proactive management prevents failures

  • Use a dedicated tool like MailTester to monitor DKIM key status across domains in real time.
  • Schedule health checks every 3–6 months, especially after DNS or email infrastructure updates.
  • Avoid embedding keys directly in code; use secure vaults or environment variables instead.

Layering is key to resilience

DKIM alone isn't enough. Combine it with SPF and DMARC to enforce alignment, detect spoofing, and improve sender reputation across major ISPs.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What causes a DKIM signature error with RSA-SHA256 hash invalid?

This error occurs when the DKIM signature does not match the public key in DNS, often due to key misplacement, formatting errors, or incorrect selector use.

Can a missing or incorrect DKIM record cause an email to be marked as spam?

Yes. A failed DKIM verification harms sender reputation and increases the chance of messages being flagged as spam or blocked.

How long does it take for a new DKIM TXT record to become effective?

DNS propagation typically takes 5 to 15 minutes, but can take up to 24 hours depending on TTL settings.

Do I need separate DKIM keys for each subdomain?

Yes. Each subdomain (e.g., mail.example.com vs newsletter.example.com) requires its own DKIM selector and TXT record.

Can changing my email provider break DKIM?

Yes. Switching providers often requires generating a new DKIM key and updating DNS records to avoid signature failures.

Is DKIM required for email deliverability?

DKIM is not enforced by all providers, but failure significantly reduces inbox placement chances, especially with large Senders.

How do I test if my DKIM signature is valid?

Use a tool like MailTester or a public DKIM validator to send a test message and analyze the headers for signature validation.

Can I use the same DKIM key for multiple domains?

No. Each domain must have its own unique DKIM key pair and DNS record to maintain cryptographic separation.

What happens if my DKIM key is compromised?

An exposed private key allows attackers to forge your domain’s email. Revoke it immediately and regenerate the key.

Does DKIM protect against all email spoofing?

DKIM only verifies message integrity and domain ownership. It does not stop sender address spoofing without DMARC alignment.

How does MailTester help with DKIM verification?

MailTester tests the full email chain, including DKIM signature alignment, hash matching, and DNS key validation with 98.9% accuracy.

Can I verify DKIM on an existing email list?

Yes. MailTester’s bulk verification and API can test DKIM health across large lists, identifying invalid or misaligned records.