Why is your email flagged by SpamAssassin’s DKIM checks?

You sent a clean, well-formatted email. The content is relevant. The sender is reputable. Yet it lands in spam. Why? One subtle but powerful reason: SpamAssassin’s DKIM scoring.

DKIM_INVALID isn’t just a technical flag—it’s a deliverability red light. Even if your message passes every content filter, a failed DKIM signature can drop it into spam folders. The opposite is true too: DKIM_SIGNED earns points, but only if it’s valid. Knowing how SpamAssassin assigns these scores means you’re not blind to the invisible gatekeepers of inbox placement.

Key takeaways

  • DNS-based DKIM verification failures (DKIM_INVALID) trigger automatic spam penalties, even for messages without bad content.
  • SpamAssassin awards points for DKIM_SIGNED, but only when the cryptographic signature is successfully validated against published DNS records.
  • Monitoring DKIM scores helps identify alignment issues before they harm sender reputation and inbox placement.

What does SpamAssassin’s DKIM_SIGNED score actually mean?

DKIM_SIGNED means the receiving mail server successfully validated the email’s DKIM signature, proving the message hasn’t been altered in transit and came from an authorized domain. SpamAssassin assigns it a positive score—usually between +0.1 and +1.0—indicating the email passed a basic authentication check. This improves sender credibility, but doesn’t guarantee inbox delivery.

How DKIM_SIGNED fits into spam filtering

When SpamAssassin sees DKIM_SIGNED, it knows the email was signed by a domain owner with proper cryptographic setup. This is a signal that the sender has taken a step toward legitimate email practices. However, passing DKIM doesn’t mean the email is trusted or deliverable. SpamAssassin uses this score as one piece of a broader evaluation: content, sender reputation, engagement history, and list hygiene still matter.

For example, a well-signed email from a domain known for spamming might still trigger high spam scores. Conversely, a valid DKIM signature doesn’t override a bad sender reputation or a high bounce rate. Think of DKIM_SIGNED as a "hello, I'm real" signal, not a "welcome to the inbox" pass.

Why DKIM_SIGNED alone isn’t enough

DKIM validation is just one layer. The receiving server checks if the domain’s public key is available, if the signature matches the content, and if the signing domain aligns with the "From" address (via SPF or DMARC). Even if all checks pass, SpamAssassin treats DKIM_SIGNED as a mild +1 point—insignificant on its own.

What really matters is cumulative trust. According to industry practices, a single authentication check like DKIM_SIGNED contributes to reputation over time but doesn’t override negative behavior. If you send to unengaged or invalid addresses, your reputation still degrades, regardless of DKIM.

Let’s be clear: a DKIM_SIGNED score doesn't mean you're safe. It means you've met one technical requirement. Real deliverability hinges on consistent sending behavior, responsive audiences, and clean lists.

If you're unsure whether your list meets authentication standards, test it with real inbox placement tools. MailTester’s inbox tester checks how your messages land across major inboxes, giving you a clear picture of delivery performance—alongside DKIM, SPF, and DMARC status.

Drafting emails? Verify your list first. Use the bulk verification tool to catch invalid or risky addresses before sending. You can start with 100 free verifications—no expiration, no pressure.

What triggers a DKIM_INVALID score in SpamAssassin?

SpamAssassin assigns a DKIM_INVALID score when an email’s DKIM signature is missing, malformed, or fails cryptographic validation. This commonly happens due to incorrect DKIM record setup, using the wrong selector, or changes made to the message content during transit that break the signature. A negative score—typically between -1.0 and -2.0—raises the email’s spam likelihood and can hurt deliverability.

Misconfigured DKIM records are a top cause

Most DKIM_INVALID cases stem from misconfigured DNS records. If the public key isn’t published in the right TXT record or the selector name doesn’t match, validation fails. Even minor typos in the selector or domain name can trigger the error. Tools like MxToolbox or the official RFC 6376 document the proper format and required fields, which are essential for correct implementation.

Signature tampering or transit changes

DKIM is designed to detect any alteration to the email body or headers after signing. If a gateway, relay, or mailing system modifies the message—adding tracking pixels, inserting headers, or reformatting content—the signature becomes invalid. This is common with some ESPs or email forwarding services that don’t preserve the original signature. While this isn’t malicious, it still triggers DKIM_INVALID.

DNS-based checks alone won’t catch all issues—you need real verification tools to test actual email behavior. At MailTester, our inbox placement testing simulates real-world delivery conditions, including how gateways handle DKIM-signed messages. You can test your outbound emails before sending at scale using our inbox tester or check individual addresses with our verification API. For large lists, bulk verification ensures your sender reputation stays intact.

Fixing DKIM_INVALID means reviewing DNS records, double-checking the signing process, and ensuring no intermediaries alter the message. It’s not just about setting up a record—it’s about maintaining it and validating it across real delivery paths. Even a small mistake here can mean your emails land in spam or fail outright.

How can you verify if your DKIM setup is working?

You can verify your DKIM setup by checking DNS TXT records for the correct selector and public key format, ensuring your mail server signs messages with the right private key and selector, and using tools like MxToolbox or MailTester’s API to test individual or bulk domains. If your messages still score high on SpamAssassin’s DKIM_INVALID or DKIM_SIGNED checks, a misconfiguration is likely. Let’s walk through the fixes.

DNS and Signing Configuration

  • Use RFC 6376 as a reference to verify your DKIM DNS record follows the correct structure, including the selector._domainkey.example.com format.
  • Check that the TXT record includes the v=DKIM1; tag and a p= tag with a properly formatted public key (no extra spaces, line breaks, or truncation).
  • Confirm your email server is signing outbound messages with the correct private key and selector — the signing key must match exactly what’s published in DNS.
  • Use MxToolbox to scan your domain’s DKIM record and validate the DNS publication.

Real-World Testing

  • Send a test message to a known inbox, then check the message headers using a tool like Mail-Tester.com to verify DKIM signature presence and validity.
  • Use the MailTester API to check multiple domains or emails at scale and get detailed validation results, including DKIM status and any scoring anomalies.
  • For bulk validation, run your list through the MailTester bulk verification tool to catch domain-level DKIM misconfigurations early in campaigns.
  • If DKIM_SIGNED is flagged but not valid, the signature was created but doesn’t match the public key — check for incorrect key placement, wrong selector, or header modifications during transit.
DKIM isn’t just a formality. A failed signature can push your email into spam folders — even with flawless content.

Most DKIM issues stem from configuration missteps, not delivery problems. The fix is precise: match DNS records exactly, use valid keys, and test with real email headers. If you’re running campaigns at scale, integrate MailTester with SendGrid, Mailchimp, or HubSpot to catch issues before they affect sender reputation. Your inbox placement depends on it.

DKIM_SIGNED vs DKIM_VALID_AU: what’s the difference?

DKIM_SIGNED means the email has a properly formatted DKIM signature that validates against the public key in the DNS record. DKIM_VALID_AU goes further: it confirms the signature is valid AND was issued by the authorized sender domain. If the signing domain doesn’t match the author domain — even with a correct signature — you’ll see DKIM_SIGNED but not DKIM_VALID_AU, which lowers trust in the message.

How DKIM validation works in practice

Let’s say your email is signed with a key published under mail.example.com, but the message claims it came from example.com. The signature is formatted correctly — so SpamAssassin logs DKIM_SIGNED. But since the signing domain doesn’t match the author domain, it doesn’t meet the stricter check for DKIM_VALID_AU.

This is a common issue when using third-party email services. You might be sending from mail.company.com, but the domain in the “From” header is company.com. If the DKIM record at company.com isn’t correctly set up to allow signing by the service, it fails DKIM_VALID_AU, even if the signature itself is technically correct.

SpamAssassin uses both checks to assess legitimacy. A message with only DKIM_SIGNED scores lower than one with DKIM_VALID_AU. The difference isn’t just about technical correctness — it's about trust. The VALID_AU check ensures the domain owner authorized the signature.

The SPF, DKIM, and DMARC checks are not standalone; they work together. A single failure in any can reduce deliverability, even if others pass.

What you should do if you’re seeing inconsistent DKIM scores

If you're receiving DKIM_SIGNED but not DKIM_VALID_AU, double-check your domain’s DKIM records. The public key must be published under the domain that appears in the envelope sender (the "From" domain), not just a subdomain or third-party service.

Use tools like MxToolbox’s DKIM validator or RFC 6376 to inspect your DNS records and ensure they align with your sending domain. You can also test real-world inbox placement with MailTester’s inbox placement tool, which checks how your messages behave across major providers.

For bulk email lists, pre-verification can catch invalid, catch-all, or misconfigured domains before sending. Use MailTester’s bulk verification to clean your list and avoid sending to domains with broken DKIM setups. You can also integrate the verification API into your workflow to catch issues early.

Real-world example: how DKIM_INVALID hurt deliverability

After switching email providers, a mid-sized e-commerce brand saw inbox delivery drop from 92% to 62% in just one week. Their SpamAssassin logs revealed consistent DKIM_INVALID scores, caused by outdated DKIM records in DNS. Once they updated their DKIM keys and validated the signing process using real-time tools, delivery returned to 92% within 48 hours.

What went wrong: outdated DKIM records in DNS

When they migrated providers, the old DKIM public key remained in DNS. New emails were signed with the new key, but receiving servers checked the old record. SpamAssassin flagged this mismatch as DKIM_INVALID, assigning a strong negative score. This isn’t rare—SPF and DKIM alignment failures are among the top technical blockers to inbox placement.

DKIM_INVALID is clear: the signature is present, but it doesn’t match the current key. It’s not that the message is suspicious—it’s that the cryptographic proof fails. This can happen if keys aren’t rotated after migration, if DNS records are stale, or if signing is misconfigured on the sending server. The impact? Recipients see the email as untrusted, even if it’s perfectly legitimate.

Fixing it: verification and alignment

Let’s be clear: just having DKIM on a message isn’t enough. The key must be publicly accessible in DNS and correctly aligned with the domain in the From header. A simple DNS check won’t catch mismatches—proof of signature validity requires real-time testing with a verified recipient environment.

They used MailTester’s inbox placement tool to simulate delivery across major inboxes and validate DKIM signatures live. The result? A clean pass on all tests after updating the DNS entry. No code changes were needed—just ensuring the new key was published and active. The SpamAssassin logs stopped reporting DKIM_INVALID. Deliverability recovered fully within two days.

DKIM is a technical safeguard, not a magic bullet. If your setup isn’t aligned with current DNS records, your messages will score poorly—even if the content is clean. It’s not hard to fix, but it’s easy to overlook. Tools like MailTester’s inbox placement tester help spot these issues before they cost you revenue.

For ongoing checks, their team runs bulk verification using MailTester’s list verification tool to clean outdated or invalid addresses before campaign sends. Every few months, they validate their DKIM configuration—because a single mismatch can cost you 30% of your audience.

SpamAssassin’s scoring is deterministic. DKIM_INVALID is not a suggestion—it’s a signal of failed validation. The fix isn’t complexity. It’s consistency. Make sure your domain’s public keys match your signed messages. That simple step stops many bounces before they happen.

For details on how DKIM works under the hood, refer to RFC 6376, which defines the DKIM standard. It’s not required reading—but it’s useful when debugging scoring issues.

How to prevent DKIM_INVALID errors before they happen

You can avoid DKIM_INVALID errors by validating your DKIM records before sending, using real-time verification tools to catch invalid signatures early, and automating checks in your email workflow. This stops bounces and inbox placement drops before they happen.

Validate DKIM records before sending

DKIM works only if your DNS records are correct and properly formatted. A single misconfigured key or expired signature will trigger a DKIM_INVALID score in SpamAssassin. Use a trusted tool like MxToolbox's DKIM Checker to validate your DNS records in real time.

Let’s say you’ve just set up a new email domain. Don’t assume the DKIM record is correct. Copy the public key from your email provider, paste it into the checker, and confirm it resolves. If it doesn’t, the recipient’s server will flag it as invalid — even if your content is clean.

Use real-time verification to catch invalid signatures

DKIM is only one part of sender reputation. An email can have a valid signature but still fail due to spammy content or a poor sender history. Use a service like MailTester to test entire lists or individual addresses before sending.

MailTester’s real-time verification API (API endpoint) checks for DKIM_SIGNED and DKIM_INVALID flags during verification. It identifies malformed or missing signatures that might otherwise slip through. This catches issues early — before you send 10,000 emails with a broken signature.

  • Verify your DKIM records using an authoritative tool like MxToolbox before enabling them for outbound mail.
  • Use MailTester’s bulk verification (bulk list verification) to check entire lists for DKIM_INVALID and other delivery risk flags.
  • Automate checks in your workflow: integrate MailTester API into your list import or campaign setup process.
  • Set up pre-send validation for campaigns — test every email address before the send.
  • Monitor your sender reputation with inbox placement tests (inbox tester) to uncover hidden DMARC or DKIM issues.

SpamAssassin scores DKIM_INVALID when it can’t confirm a valid signature. Prevention isn’t about luck — it’s about consistency. A single malformed key can damage your deliverability. The fix is simple: test before you send.

“DKIM validity is a non-negotiable baseline for inbox placement.” — Industry best practices (Spamhaus, 2023)

SpamAssassin scores don’t lie: here’s how MailTester helps

SpamAssassin flags emails with DKIM_INVALID or DKIM_SIGNED because they either lack a valid signature or have one that fails verification. MailTester checks DKIM in real time—validating DNS records and signature authenticity—so you know upfront if an address is vulnerable to spam filtering, even before you send. With 98.9% accuracy, it reduces the risk of sending to domains with broken or missing DKIM setups.

How DKIM validation stops bounces and blocklists

When an email fails DKIM, SpamAssassin assigns a penalty—often enough to push your message into the spam folder or block it outright. This isn’t guesswork. The scoring is based on industry-standard checks, and tools like SpamAssassin are trusted by mail providers and security teams alike. According to the RFC 6376, DKIM validation requires both correct DNS alignment and a cryptographically valid signature. MailTester performs both checks in under a second.

Many email lists contain addresses with misconfigured or non-existent DKIM records. These are high-risk targets—even if the address is syntactically valid, they can still fail delivery. MailTester surfaces these issues immediately, returning a clear verdict: valid, invalid, catch-all, or risky. You don’t have to interpret gray areas or second-guess a scoring pattern.

Clear verdicts, fewer surprises

Instead of relying on fuzzy thresholds or incomplete diagnostics, you get a definitive result. A DKIM_INVALID rating means the signature check failed—either the DNS record is wrong, or the signature is tampered with. A DKIM_SIGNED but invalid status means the signature exists but doesn’t match the content, suggesting a server misconfiguration.

Let’s be honest: no tool catches every edge case—spammers evolve. But MailTester closes the gap between theory and reality. By testing actual DNS records and signature validity under real SMTP-like conditions, it gives you a reliable snapshot of deliverability risk. You’re not just checking syntax. You’re verifying cryptographic integrity.

Whether you’re running a bulk send via bulk verification, integrating with your CRM through our real-time API, or testing inbox placement with inbox tester, you’re working with data that reflects actual delivery conditions.

And yes, it’s reliable enough that even teams with strict compliance needs use it to pre-verify high-volume campaigns. The 98.9% accuracy rate comes from continuous validation against real email infrastructure—no guesswork, no proxies, no shortcuts.

The full picture: how DKIM fits into email deliverability

DKIM isn't a standalone pass-or-fail test—it's one part of a three-layer authentication stack. SPF, DKIM, and DMARC must all align to signal trust. A single mismatch, like a failed DKIM signature, can trigger spam filters even if SPF passes. Maintaining clean technical setup across all three improves sender reputation over time.

DKIM is not a magic bullet—it’s part of a chain

Let’s be clear: DKIM is only one piece of the authentication puzzle. Even if your DKIM signature is valid, an SPF mismatch or a missing DMARC policy can still sink your deliverability. SpamAssassin, for instance, assigns scores like DKIM_INVALID or DKIM_SIGNED based on the signature’s validity and alignment, but it doesn’t act in isolation. It weighs this against other signals: sender reputation, content, and inbox behavior.

Think of it like a security checkpoint. You need your ID (SPF), your fingerprint (DKIM), and your biometric scan (DMARC) all to match. Fail one, and the system flags the entire transmission. RFC 6376, which defines DKIM, emphasizes this interdependence—it’s built to verify domain control, not content legitimacy.

Consistency wins: clean configs build reputation

Even valid DKIM signatures can trigger red flags if they’re inconsistent. Missing or malformed DNS records, domain alignment issues, or signing headers that don’t match the envelope can all cause scoring errors. These aren’t just technical glitches—they reflect on your sender reputation. Over time, repeated failures, even minor ones, can degrade your standing with major email providers.

Tools like MailTester help you catch these issues early. With real-time verification and inbox placement testing, you can validate DKIM alignment, detect catch-all domains, and spot risky senders before they affect open rates. For teams using bulk sending, using the bulk verification tool ensures your lists are clean at scale.

Ultimately, email deliverability isn’t about avoiding a single score—it’s about maintaining consistency across multiple layers. Regular checks, accurate DNS records, and aligned authentication protocols reduce the risk of being flagged—even when SpamAssassin assigns a DKIM_SIGNED or DKIM_INVALID score. That’s how reputation is built: not by luck, but by precision.

Use MailTester to test deliverability before your next send

Running inbox placement tests with MailTester shows exactly whether your email lands in inboxes or gets blocked—before you send. It catches DKIM issues, validates deliverability, and integrates with your existing tools. You fix problems early, before they hurt sender reputation.

Test your deliverability with real inbox placement

  • Use MailTester’s inbox placement tool to send test emails to real inboxes across Gmail, Outlook, Apple Mail, and Yahoo—no fake accounts, no assumptions.
  • Check spam signal scores like DKIM_INVALID and DKIM_SIGNED from actual filters in real time.
  • See how high your email lands in the inbox—top, middle, or in spam—based on real-world behavior, not theoretical scoring.
  • Test before bulk sends to catch issues like missing or malformed DKIM signatures that trigger filtering.
  • Use the inbox tester to validate your sender setup, domain alignment, and message content.

Automate verification and fix issues before you send

  • Integrate MailTester with Mailchimp, SendGrid, Klaviyo, or HubSpot to verify lists automatically during onboarding or campaign prep.
  • Run bulk list verification to flag invalid, catch-all, disposable, or role-based addresses that can harm your domain reputation.
  • Use the bulk email verification tool to clean your list and remove risk factors before every campaign.
  • Validate DKIM configuration with the real-time API to catch malformed or missing signatures before sending.
  • Fix sender reputation risks early—reduced bounces, fewer spam complaints, better inbox placement.
  • Keep your sender score above 85 (a benchmark for strong deliverability) by proactively testing and repairing issues.
SpamAssassin scoring like DKIM_INVALID isn’t just a warning—it signals that your message may be rejected or routed to spam. Fixing it is non-negotiable for deliverability.

MailTester doesn’t just detect the problem—it shows you the fix. Whether you’re sending transactional emails or marketing campaigns, running inbox placement tests and verifying your list reduces risk and protects your sender reputation. With real-time API integration and no expiration on credits, it’s a reliable layer in your deliverability workflow.

Conclusion: stop guessing, start verifying

DKIM_INVALID and DKIM_SIGNED are not obscure technicalities. They directly influence whether your email reaches the inbox or gets filtered.

Log data alone can’t tell you if an email is deliverable. You need scalable, real-time validation to catch issues before they hurt your sender reputation.

Use inbox-placement testing and bulk verification to confirm your emails pass the real-world checks that matter.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What happens when SpamAssassin scores DKIM_INVALID?

DKIM_INVALID triggers a negative score in spam filters, which reduces the chances your email lands in the inbox. This can harm sender reputation over time.

Is DKIM_SIGNED enough to ensure inbox delivery?

No. DKIM_SIGNED confirms the signature was validated, but deliverability depends on SPF, DMARC, content quality, and sending behavior.

How does DMARC relate to DKIM_INVALID scoring?

DMARC uses DKIM validation results to enforce policies. If DKIM fails (DKIM_INVALID), DMARC alignment fails, leading to rejection or quarantine.

Can a valid DKIM signature still be rejected?

Yes. Valid signatures don't guarantee delivery. Rejection can occur due to spam content, poor sender reputation, or email throttling.

How does MailTester detect DKIM_INVALID?

MailTester checks DNS records and simulates message signing to detect misconfigurations, mismatched keys, or lack of signatures.

Can you verify DKIM on a large email list?

Yes. MailTester’s bulk verification feature checks DKIM validity across thousands of addresses in minutes.

Does MailTester support real-time API checks for DKIM?

Yes. The MailTester API returns detailed verification results, including DKIM validity, catch-all status, and risk indicators.

How accurate is MailTester’s email verification?

MailTester achieves 98.9% accuracy in determining valid, invalid, and risky addresses, including DKIM-related issues.

Can I integrate MailTester with SendGrid?

Yes. MailTester integrates with SendGrid, enabling real-time verification on list imports and delivery monitoring.

Do purchased MailTester credits expire?

No. Purchased credits never expire, giving you flexibility to verify emails on demand without time pressure.

How many free verifications do I get with MailTester?

You get 100 free verifications to start, with no expiration or time limit on usage.

Is it safe to use MailTester with sensitive email lists?

Yes. MailTester processes data securely and does not store email lists long-term unless explicitly retained.