Interpreting DKIM Permfail

What does DKIM permfail actually mean?

You sent an email. The recipient’s inbox says “failed to verify.” You check the headers. It says DKIM permfail. Now what?

It’s not a temporary hiccup. It’s a hard stop. DKIM permfail means the email’s digital signature didn’t check out — and won’t be trusted by the receiving server.

Unlike a tempfail, which might resolve on retry, a permfail means the signature is permanently invalid. That could mean a key expired, was misconfigured, or the public key in DNS doesn’t match the one in the email.

Understanding what permfail really means cuts through guesswork. It’s not just a flag; it’s a diagnostic tool. If you’re seeing permfail, you’re not just losing deliverability — you’re likely leaking a gap in your email authentication setup.

Key takeaways

DKIM permfail indicates a permanent failure in signature verification — the message will not pass security checks.
Unlike tempfail, permfail usually signals a misconfiguration, expired key, or DNS mismatch that cannot be fixed by retrying.
Validating the public key in DNS against the one in email headers is essential to prevent permfail.

How DKIM authentication works in practice

When you send an email, your server signs it with a private key linked to your domain. The recipient’s server checks the signature using the public key from your domain’s DNS, using the selector in the DKIM header. If the message content has changed—哪怕是一次空格或换行—the hash won’t match, resulting in a permfail. A permfail means the signature is invalid and the failure is permanent, not due to a temporary glitch.

The DKIM verification process, step by step

Your server signs the email with a private key. This happens automatically when your mail server is configured for DKIM. The signature includes a hash of parts of the email (like headers and body) and is tied to your domain and a selector (e.g., default._domainkey.yourcompany.com).
The recipient’s server retrieves the public key from DNS. It looks up the DNS record using the selector from the DKIM signature. That key is published in a TXT record under your domain, and is publicly accessible.
The receiver recalculates the hash based on the received message. It rebuilds the hash of the same email components it expects—based on the DKIM header—and compares it to the one sent in the signature.
If the hashes match, it’s a pass. The email is authenticated, and the receiver can trust it came from your domain and wasn’t altered in transit.
If the hashes don’t match, it’s a fail. If the failure is due to a temporary issue like a server outage or rate limit, it might be retryable. But if the failure is permanent—like a mismatched key or modified content—it’s labeled a permfail. This signal is hard and indicates broken authentication.

Why permfail matters in inbox placement

Permanently failing DKIM is a red flag for email receivers. Major providers like Gmail and Outlook treat permfail as a strong signal that the email may be spoofed or tampered with. If DKIM fails consistently, your domain’s sender reputation suffers. This impacts inbox placement: even legitimate emails may end up in spam or be rejected outright.

The 5 steps described in “The DKIM verification process, step by step”, in order.

While you can’t control all receiving servers, you can prevent permfail by ensuring your signing key is correct, your DNS records are stable, and your email content isn’t altered in transit (e.g., by third-party relays). Always test your DKIM setup using real email test tools.

Use MailTester's inbox placement tests to check how your emails are perceived across real inboxes, including whether DKIM authentication succeeds or fails across different providers. For bulk list hygiene, verify your email lists upfront to avoid sending to domains with broken or invalid DKIM configurations.

Common causes of DKIM permfail

DKIM permfail means the receiving server checked your signature but found it invalid—usually due to a mismatch between the signing key and what’s in DNS. This can stem from outdated records, an unchanged DNS entry after your ESP changed keys, or actual message tampering. Let’s break down the most frequent root causes.

Outdated or incorrect DNS records

You’re using a DKIM selector or public key that no longer matches your current signing setup.
Some ESPs rotate signing keys automatically—your DNS record must reflect the current one.
Check your domain’s DNS records with a tool like MXToolbox to verify the DKIM TXT record matches your provider’s latest configuration.

Changes in signing keys without DNS updates

If your ESP changed the DKIM key (e.g., for security rotation), but you didn’t update the DNS record, all messages will fail permchecks.
Even small delays in updating DNS can cause a sudden spike in permfail errors across your domain.
Set up monitoring to catch when your sender’s key changes—many ESPs log these transitions.

Message manipulation during transit

DKIM signatures are sensitive. Even minor header changes (like adding a tracking parameter or altering capitalization) break the signature.
Some filters, forwarders, or email gateways modify content—this is a common source of permfail in practice.
Use an inbox placement test to see if your messages are being altered in real-world delivery (try MailTester’s inbox placement checker).

Missing or malformed DNS records

If the DKIM TXT record is missing, malformed, or returns a timeout during lookup, you’ll get a permfail—even if your signature is correct.
Check for syntax errors (e.g., missing quotes, malformed value format).
Use RFC 6376 as a reference when validating the structure of your DKIM record.

Expired or revoked keys

Keys can be intentionally revoked or expire naturally. If you’re not notified, your emails will fail permcheck.
Signing keys may be retired after a security incident or scheduled rotation.
Verify that your private key hasn’t been invalidated in your ESP dashboard or key management system.

How to diagnose DKIM permfail using MailTester

When MailTester returns a permfail for DKIM, it means the signed email failed validation permanently—your domain’s public key doesn’t match the signature, or the signing process was flawed. Use the real-time verification API to test specific addresses and inspect the full authentication chain, including SPF and DMARC results, to determine if the issue is isolated to DKIM or part of a larger alignment problem.

Check the full authentication chain in the API response

Send a request to MailTester’s verification API with the email address in question. The response includes a dkim field with one of four outcomes: pass, fail, tempfail, or permfail. A permfail means the signature is invalid and won’t be corrected by retries. It’s not a temporary glitch—it’s a persistent misconfiguration.

Look for additional signals: SPF results (e.g., pass, fail) and DMARC results (e.g., pass, none). If SPFs also fail but DKIM passes, the issue may be in sender alignment. If DMARC fails or is not enforced, a permfail in DKIM might still allow delivery, but can hurt sender reputation over time. These insights help you decide whether the root cause is misaligned DNS records, incorrect signing setup, or a broken key.

Verify your domain’s public key and signing setup

DKIM permfail nearly always means the public key published in DNS doesn’t match the private key used to sign messages. Check your domain’s TXT record under default._domainkey.yourdomain.com—it should contain a valid public key that matches your email service provider’s (ESP) signing configuration.

Let’s say you’re using SendGrid or Amazon SES: if your ESP configures DKIM signing, their key must be published in your DNS. If it isn’t, or if it was updated but not published, you’ll get permfail. Use RFC 6376 as a reference for the exact structure of DKIM records. Also, ensure no changes to your email infrastructure (e.g., switching from one ESP to another) were made without updating DKIM records.

MailTester’s email checker allows you to test a single address for authentication results without committing to a full list. For larger volumes, use bulk verification to spot patterns—common permfail rates across many addresses suggest a systemic issue rather than isolated misdelivery.

What role does sender reputation play when DKIM permfail occurs?

DKIM permfail directly harms sender reputation because it signals inconsistent or insecure email practices. Receiving servers treat repeated permfail events as red flags — potential signs of spoofing, phishing, or compromised infrastructure. Even a single consistent permfail can trigger filtering or rejection, especially if your domain has weak engagement history or poor deliverability signals.

How permfail disrupts trust in your sending infrastructure

When a DKIM check returns a permfail, it means the signature failed validation and the result is permanent — not temporary, not due to a delay. The receiving server treats this as evidence the message was not sent by an authorized source, or the message was altered in transit. For systems that prioritize security, this is a strong signal that something is off.

Reputable email providers and filtering engines, like Microsoft’s Exchange Online Protection and Google's Gmail infrastructure, correlate permfail patterns with sender reputation scores. Studies on email authentication trends — such as those published by RFC 6376 and monitored by Spamhaus — show that consistent authentication failures correlate with higher spam likelihood and increased delivery drops.

Why consistency across SPF, DKIM, and DMARC matters

High-performing senders maintain 99%+ alignment across SPF, DKIM, and DMARC. A permfail breaks this consistency. Even if SPF passes and DMARC policy is aligned, one failed DKIM signature means your domain’s authentication stack is fractured — and that’s enough to trigger filtering.

Let’s say you’re sending to a large enterprise list and your DKIM signature fails consistently — the domain’s reputation takes a hit, even if the content is clean. Subsequent messages are more likely to be quarantined or blocked, especially if engagement (opens, clicks) is low. Once reputation drops, recovery is slow and requires sustained clean sending behavior.

Use tools like MailTester’s email checker to verify individual addresses before sending, or run a bulk verification on your list to detect and remove addresses that return permfail or other authentication errors. Catching these issues early prevents reputation decay before they reach the inbox.

Why DKIM permfail is not the same as SPAM or bounce

DKIM permfail means the email reached the recipient’s server but was cryptographically rejected — it’s not a bounce, not spam, and not a delivery failure. The message arrived but failed authentication due to a broken or mismatched digital signature. This often leads to silent delivery (into spam or junk folders) without a bounce, harming deliverability without clear signs. Unlike spam or bounces, permfail signals a technical misconfiguration, not content or sender reputation issues. You can test for this directly using tools like MailTester’s inbox placement or email checker.

What DKIM permfail really means

It's not a bounce — the email was accepted by the recipient server, but the signature check failed. Bounces happen when the server refuses the message outright, usually due to invalid addresses or server rejection.
It's not spam — spam filters look at content, sender history, engagement, and list hygiene. DKIM permfail is about cryptographic validation of the sender’s identity, not message content.
It’s a protocol-level issue — if the private key used to sign the email doesn’t match the public key published in DNS, the receiving server rejects the message even if the address is valid.
It often results in silent delivery — the email is received but marked as untrusted or moved to spam. This harms inbox placement without triggering a bounce, making it harder to detect.

Why this matters for deliverability

Because permfail doesn’t trigger a bounce, you won’t see it in standard delivery reports. But it still harms sender reputation. Major providers like Google and Microsoft use DKIM validity as part of their authentication stack. A consistent permfail rate can reduce trust, even if messages appear to deliver.

Tools like inbox placement testing can help simulate real delivery conditions and detect permfail issues before you send. You can also validate individual addresses with the email checker to catch misconfigured domains early.

For bulk sends or ongoing list health, use the bulk verification tool to check large lists for permfail risk and other delivery blockers. This helps maintain sender reputation and ensures your messages are both accepted and trusted.

Digital signatures are part of a larger chain — SPF, DKIM, DMARC. When one fails, it can trigger cascading issues. See RFC 6376 for the technical specification of DKIM, and the Messaging Security Alliance (https://www.messagingsecurityalliance.org) for industry guidance on authentication best practices.

How to fix DKIM permfail across email platforms

DKIM permfail means your email’s signature doesn’t match the public key in DNS. Fix it by verifying your selector, ensuring your ESP doesn’t rotate keys silently, testing with tools like MailTester, confirming all senders use correct keys, and validating your private key and DNS records. Consistency across systems is key.

Confirm the DKIM selector in your DNS matches the one used during email signing. A mismatch here is the most common cause of permfail. Verify that the selector (e.g., mail in mail._domainkey.yourdomain.com) in your DNS record exactly matches the one your email system uses to sign messages. Even a tiny typo breaks the authentication chain.
Check whether your ESP or email service rotates keys automatically without updating DNS. Some platforms like SendGrid or Mailchimp rotate keys during maintenance or due to security policies. If the public key in DNS doesn’t update in sync, permfail occurs. Review your provider’s documentation or support policies around key rotation, and set up alerts if possible.
Use MailTester’s inbox placement tester to run a sample of emails and spot consistent permfail patterns. Run a small batch of test emails through MailTester’s inbox tester to see whether permfail appears consistently across recipients or only for certain domains. This helps isolate whether the issue is misconfiguration or something external like receiving server behavior. Test your sender reputation and deliverability across real inboxes to get real-world feedback.
Verify that every sender using your domain—internal teams, third-party tools, or ESPs—signs with a correctly configured DKIM key. If you use multiple platforms (e.g., Mailchimp for campaigns, SendGrid for transactional), each must be individually configured with the right selector and key. A single misconfigured sender can trigger permfail for all messages from that domain.
For self-hosted SMTP, double-check the validity of your private key and the DNS publication of the public key. Ensure the private key used to sign messages hasn’t expired or been incorrectly generated. The public key in DNS must be exactly as published—no line breaks, no trailing spaces. You can use RFC 6376 to verify the expected format and structure.

Common pitfalls to avoid

Don’t assume a working DKIM setup is always stable. Key rotations or config drift happen silently.
Don’t rely on outbound email reports alone—real-world testing with tools like MailTester shows what actual inbox filters see.
Don’t mix selectors across systems. If one system uses default and another uses mail, permfail will occur for one or both.

DKIM failure is not always about the email—it’s about consistency in how your entire sending infrastructure interacts with DNS.

What does a 98.9% verification accuracy mean for DKIM diagnostics?

MailTester’s 98.9% accuracy means that when it flags a DKIM permfail, you can trust it’s correct 98.9% of the time—close enough to act on as a high-confidence signal, not a guess. This precision means you’re far less likely to waste time chasing false positives in your email authentication chain. It’s not a substitute for direct header or DNS checks, but it gives you a fast, scalable way to spot recurring issues across hundreds or thousands of addresses.

Why accuracy matters when diagnosing DKIM permfail

DKIM permfail indicates a fundamental mismatch in the cryptographic signature verification process—usually due to misconfigured DNS records, altered headers by an intermediary, or a flawed signing setup. A misidentified permfail wastes time and can obscure real problems. With 98.9% accuracy, MailTester’s results aren’t just fast; they’re reliable enough to prioritize. That means fewer false alerts, fewer wild-goose chases, and clearer signals when something’s wrong in your sending setup.

Let’s say you’re verifying a list of 10,000 addresses. Manually checking each header or DNS record is impossible at scale. MailTester gives you a real-time scan across your list, highlighting addresses with DKIM permfail. You’re not getting 100% certainty—but you’re getting near certainty on the majority of cases. The result is actionable intelligence: a batch of permfail results isn’t just noise; it’s a strong indicator of a configuration flaw that needs attention.

Use results as a signal, not a verdict

What MailTester tells you isn’t the full story—it’s a signal. A permfail result means the receiving server failed to authenticate the message using the DKIM signature. It doesn’t say whether it’s your fault, the sender’s, or an intermediary’s. Don’t treat a verification result as final proof. Instead, use it to drill down: check the DKIM DNS record, verify that headers weren’t modified in transit, and confirm your signing domain matches the From domain.

For example, if you see consistent permfail across a batch of addresses tied to a specific domain (like @yourcompany.com), it’s a strong sign your DKIM selector or private key setup might be off. You can then use tools like MXToolbox or RFC 6376 to validate your record. MailTester doesn’t replace that step—but it tells you where to look, fast.

Use the results from MailTester’s real-time verification API—available at the API—to integrate diagnostics into your workflow. Or, if you're validating a list before send, use bulk verification to spot systemic issues early. Accuracy like 98.9% doesn’t fix misconfigurations. But it does help you find them faster, with fewer distractions.

When to check DKIM before sending email lists

Run a bulk email list verification before any campaign to catch DKIM permfail results early. These signals often point to sender-side problems—like misconfigured keys or templates—not invalid addresses. Use MailTester’s real-time API to test individual messages during A/B testing or new campaign launch. If you see widespread permfail on your list, investigate your domain’s authentication setup before sending.

Pre-send hygiene: detect issues before they hurt deliverability

Use MailTester’s bulk verification tool to scan your entire list before sending. This reveals DKIM permfail results in context with other email health signals.
Look for patterns: if many addresses return DKIM permfail, the issue likely isn’t with the recipient’s mailbox—it’s with your domain’s authentication setup.
Permanently failed DKIM checks often indicate a mismatch between your sending domain and the signature used in the email. This can happen if templates don’t include proper key alignment or if SPF/DKIM are misconfigured.
Don’t send to lists where a significant portion shows DKIM permfail. These are high-risk recipients whose mail servers may reject your emails—or worse, mark you as spam.

Use real-time verification for precision testing

During A/B testing or when launching new campaigns, test individual messages using the verification API. This lets you check DKIM results in near real time with full control.
DKIM permfail on a single address during testing may suggest a flaw in how your email client processes the message or how your keys are published.
Check your domain’s DNS records using tools like MxToolbox or RFC 6376 to ensure DKIM records are correct and consistent across all sending environments.
If many recipients show permfail consistently across multiple campaigns, audit your email platform (e.g., SendGrid, Mailchimp) to confirm it’s signing messages correctly with your domain.

DKIM permfail isn’t a recipient issue—it’s a sender configuration signal. Ignoring it risks damaging your domain’s sender reputation.

How integrations with Mailchimp, HubSpot, Klaviyo, and SendGrid help prevent DKIM permfail

When you connect MailTester to Mailchimp, HubSpot, Klaviyo, or SendGrid, it checks email addresses in your campaign list for DKIM permfail issues during setup. You catch failed authentication early—before sending—so your messages don’t get blocked, and your sender reputation stays intact. The in-app AI assistant helps you understand why a permfail occurred and suggests fixes based on your specific platform and domain setup. Regular testing via the API ensures your DKIM alignment stays consistent over time.

Spotting permfail before you send

DKIM permfail means the email’s signature doesn’t match the domain’s public key. It often stems from misconfigured DNS records, mismatched headers, or incorrect signing practices. When integrated with your CRM or ESP, MailTester scans your list before campaign send. If an address fails DKIM verification, you get a clear alert. You can then filter out risky addresses or investigate the root cause—before sending a single email to a potentially untrusted domain.

For example, a mismatch in the d tag (domain signing context) or a corrupted signature may trigger permfail. The platform’s real-time feedback gives you time to correct the issue. This is especially useful when managing bulk lists, where even a small number of invalid addresses can degrade deliverability. According to RFC 6376—the standard for DKIM—proper key alignment is essential for trust and inbox placement.

Fixing issues with AI guidance

Not every permfail is an immediate red flag. Some domains use transitional or inconsistent signing. But when you use the in-app AI assistant, you won’t need to wade through technical jargon. It analyzes the context—your sending platform, your domain, your DKIM settings—and explains whether the issue is likely a configuration error, a temporary glitch, or a sign of a compromised domain.

For instance, if a list includes addresses from a brand-new domain that hasn’t fully propagated its DNS records, the AI might flag it as low-risk. But if the same domain consistently returns permfail across multiple sends, the system suggests auditing your signing setup. This context-aware analysis is far more reliable than a generic “invalid” label. You can then use the verification API or email checker to test individual addresses and verify the fix before resending. With MailTester’s integrations, you’re not just validating addresses—you’re aligning your infrastructure with industry standards.

See how it works in practice: integrate MailTester with your email platform of choice and start preventing DKIM issues before they impact your inbox placement.

Conclusion: Don’t ignore DKIM permfail — it’s a red flag for deliverability

DKIM permfail isn’t a minor glitch — it indicates a broken or misconfigured signature that receivers interpret as a failure in authentication integrity. This erodes trust and can trigger spam filters or outright rejection.

Even a single consistent permfail across multiple messages suggests underlying issues like incorrect DNS records, improper signing scope, or domain inconsistency that must be resolved. Ignoring it risks long-term damage to sender reputation and inbox placement.

Use MailTester’s real-time and bulk verification to proactively identify permfail patterns in your email streams. Early detection allows you to correct misconfigurations before they impact deliverability at scale.

Sources

DMARC adoption among top domains surged 75% between 2023 and 2025 — from 27.2% to 47.7% — in the wake of Google and Yahoo's bulk-sender authentication requirements. — EasyDMARC 2025 DMARC Adoption Report (2025)
Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What is the difference between DKIM permfail and tempfail?

Permfail means the signing key is permanently invalid or misconfigured. Tempfail indicates a transient issue, like DNS lookup delay, which may resolve on retry. Permfail suggests a configuration misstep.

Can DKIM permfail cause emails to be marked as spam?

Not directly, but it signals weak authentication. Receiving servers may treat repeated permfail cases as signs of spoofing, reducing inbox placement and increasing spam likelihood.

Does DKIM permfail affect all emails sent from a domain?

Not necessarily. It depends on whether the sender’s DKIM configuration is correct. If your ESP or system is misconfigured, only some sent emails may fail.

How often should I test for DKIM permfail?

Test before major campaigns and perform regular checks—especially after changing ESPs, updating keys, or altering email templates.

Can a domain have multiple DKIM keys?

Yes — you can have multiple selectors for different senders (e.g., marketing and transactional). Each must be published in DNS with the correct public key.

Why does my test email show DKIM permfail but my sent email worked?

The test may use a different signing key or template. Ensure your testing environment uses the same configuration as your live setup.

Is DKIM failure the same as a soft bounce?

No. A soft bounce is a delivery-level refusal (like a full inbox). DKIM permfail is a cryptographic failure — the message arrives but is rejected on security grounds.

Can using a proxy server cause DKIM permfail?

Yes — if the proxy modifies message content (e.g., adding headers or encoding), it breaks the DKIM signature, leading to permfail.

Should I remove emails with DKIM permfail from my list?

Only if they indicate a systemic issue with your domain configuration. It’s better to fix the root cause than delete individual addresses.

How does MailTester help with DKIM verification?

MailTester checks DKIM, SPF, and DMARC during verification. It returns real-time diagnostics on permfail and other authentication issues, helping you identify and fix problems before sending.

Are DKIM permfail rates higher in cold outreach?

Not inherently — but cold outreach often uses tools or systems with misconfigured DKIM. This increases the risk of permfail if not properly aligned.

Does DKIM permfail affect mobile devices differently?

No — DKIM is evaluated by the receiving server regardless of end-user device. Permfail affects delivery uniformly across platforms.