What does DKIM=neutral mean in a DMARC report?

You’re reviewing a DMARC report and see DKIM=neutral. Your first instinct: “Does this mean my email is broken?” Not necessarily.

DKIM=neutral doesn’t mean the signature failed. It means the signature was present and cryptographically valid, but the receiving server couldn’t accept it due to a policy or technical mismatch. It’s not a failure — it’s a policy rejection.

Understanding DKIM=neutral is critical. Misinterpreting it as a hard failure leads to wasted time fixing what isn’t broken. When you know why a signature is neutral, you can fix real issues — like conflicting DKIM selectors or key mismatches — without overreacting.

Key takeaways

  • DKIM=neutral means the signature was cryptographically valid but rejected due to policy or technical conflict.
  • It is distinct from DKIM=fail, which indicates a broken or forged signature.
  • Common causes include mismatched selectors, incorrect DNS records, or domain policy conflicts between the signing and receiving server.

Why does DKIM=neutral happen even with a valid DKIM signature?

DKIM=neutral occurs when the signature passes cryptographic verification but fails DMARC alignment checks. This often happens because the signing domain doesn’t match the From: header domain, the wrong DKIM selector was used, the public key is invalid or missing, or the DKIM header is malformed. Even if the signature is mathematically correct, DMARC policies can still reject it if alignment isn’t strict. Let’s break down the most common causes.

Selector mismatch or invalid key

You might have a valid DKIM signature, but if the selector in the signature (like mail._domainkey.example.com) doesn’t match the one published in DNS (such as default._domainkey.example.com), DMARC will return neutral. The receiving server checks the DNS record for that exact selector. If it’s missing or the public key is expired or malformed, even a correct signature fails alignment.

According to RFC 6376, the selector must be retrievable via DNS, and the key must be valid at the time of verification. If you’re using a non-standard selector (e.g., smtp._domainkey), make sure that’s the one your domain publishes. You can verify DNS entries using tools like MXToolbox.

Domain or header misalignment

Even if the DKIM signature is cryptographically sound, it must align with the From: header domain. If a message is signed with example.com but the From: header says [email protected], alignment fails. This is especially common in B2B or multi-domain email systems.

Additionally, some servers enforce strict DKIM header formatting. If the b= field is missing, truncated, or improperly base64-encoded, the signature will be rejected—even if the public key is correct. Malformed headers often trigger neutral or soft fail results, even when cryptographic checks pass.

Strict validation policies

Some receiving servers apply stricter validation than standard. They may reject signatures that pass verification under RFCs but don’t meet internal policy thresholds—such as requiring a minimum key size, exact header ordering, or specific algorithm alignment.

To catch these issues early, test your email flows before sending. Use a real-time email verification tool like inbox placement testing to simulate how your messages land in inboxes and catch alignment issues before they impact deliverability.

How does DKIM=neutral affect email deliverability?

DKIM=neutral reduces your message’s chances of passing DMARC checks, which many email receivers enforce strictly. Even if your email passes SPF and has a valid From address, a neutral DKIM result can still lead to your message being treated as unverified—pushing it to spam or silently dropping it, especially if other alignment issues exist. Over time, repeated neutral results degrade sender reputation, even if no hard bounces occur.

Why DMARC-compliant receivers treat DKIM=neutral as a red flag

DMARC policies rely on alignment between SPF, DKIM, and the visible From address. When DKIM returns a neutral verdict, it means the signature was technically valid but couldn’t be verified—often because the public key isn’t found, or the selector mismatched. Receivers like Microsoft, Google, and Apple often treat this as a failure in the authentication chain. Even if the message isn’t outright rejected, it loses credibility in their filtering systems.

Many strict receivers apply a weight against inbox placement for neutral results, especially when combined with other signs of misalignment. A message might bypass the spam filter once, but if neutral DKIM occurs consistently across multiple sends, the sender is flagged as unreliable over time.

What happens to messages with DKIM=neutral?

These messages rarely trigger hard bounces, which makes the problem invisible to most senders. Instead, they’re often quietly moved to spam folders or dropped entirely by high-security filters. This results in poor deliverability without clear warning signs, leading to lost engagement and inaccurate open rates.

Long-term, DMARC reporting tools like those used by Return Path and Google Postini have shown that consistent neutral or fail verdicts correlate with declining reputation scores. It’s not just about the current email—it’s about how your domain is perceived over time.

You don’t need to wait for blocklists to catch up. Proactively verify your DKIM setup before sending. Use a real-time check to identify domains with failing or neutral signatures before they damage your sender reputation. Test individual addresses to spot issues early, or validate entire lists with bulk verification to clean your database before deployment.

For a deeper look, refer to the official DMARC specification, which outlines how neutral results are handled during policy evaluation. Monitoring your DMARC reports regularly is the only way to stay ahead of these subtle threats.

How can you verify if a DKIM signature is actually valid?

You can verify a DKIM signature’s validity by checking the DNS-published public key, ensuring the d= domain matches the From: header, confirming the s= selector exists in DNS, verifying the b= value is correctly Base64-encoded without extraneous characters, and cross-checking the signature's cryptographic consistency using a public validator. For real-time verification, use MailTester’s API to automate this process across bulk lists.

Check the core signature components

  • Retrieve the DKIM public key from DNS using the selector (s=) and domain (d=) in the signature. You can check this via MxToolbox’s DKIM checker or directly query the DNS record.
  • Ensure the d= tag in the DKIM-Signature header exactly matches the domain used in the From: header. A mismatch here means the signature is syntactically valid but cryptographically irrelevant to the sender.
  • Confirm the s= selector in the signature matches one published in DNS under a selector._domainkey.yourdomain.com record. If no record exists, the signature cannot be verified.
  • Verify the b= field is Base64-encoded and contains only valid characters (A–Z, a–z, 0–9, +, /, =). Any line breaks, extra whitespace, or invalid characters break the signature.

Validate cryptographic integrity

  • Use a trusted DKIM validator like MxToolbox’s DKIM checker to input the full DKIM-Signature header and the raw, undelivered email body. The tool will verify signature consistency with the public key.
  • Check that the hash of the signed headers and body (as specified in RFC 6376) matches the value in the b= field. A mismatch confirms the signature was altered or forged.
  • For automated checks across large volumes, integrate MailTester’s real-time verification API to test DKIM validity at scale, along with other deliverability signals like DNS records and inbox placement.

How to fix a DKIM=neutral result in a DMARC report

If your DMARC report shows DKIM=neutral, it usually means the signature was present but couldn’t be validated—often due to a mismatched domain, incorrect selector, or malformed DNS record. Let's fix it step by step, using industry-standard checks to ensure the signature aligns exactly with DNS records.

Verify the DKIM signature alignment

  • Ensure the domain in the From: header matches the d= tag in the DKIM-Signature header. A mismatch here causes DKIM=neutral even if the signature is technically correct.
  • Use the same selector (e.g., default, mail, or a custom name) in both the signing process and the DNS TXT record. If you sign with s=mail but publish the key under default, validation fails.
  • Check that your DNS TXT record contains the full public key in the correct format: v=DKIM1; k=rsa; p=MIIB...{key}. Any missing, truncated, or malformed parts break validation.

Check key integrity and processing chain

  • Confirm the RSA key hasn’t expired or been revoked. Keys typically expire after 3–5 years; verify the p= value hasn’t changed and is still valid per RFC 6376.
  • Make sure no relay, outbound gateway, or ESP (like SendGrid or Mailchimp) is modifying or stripping headers mid-flight. Intermediaries that alter headers can invalidate signatures unless the signing system accounts for it.
  • Test the full path using DMARCian’s DKIM checker or MXToolbox to simulate real-world delivery and verify how the signature is received.

Once you’ve validated all alignment and configuration points, re-run your DMARC report. A persistent DKIM=neutral usually points to a third-party service intercepting or mismanaging the signature. If you’re using a service provider, confirm they preserve the original DKIM-Signature header. For high-volume senders, consider running a full inbox placement test with an inbox tester to see how your mail performs across real inboxes, including whether the signature is honored.

Why standard email verification tools miss DKIM=neutral issues

Most email verification tools check if an address exists and can receive mail, but they don’t validate whether the DKIM signature will be accepted by receiving servers. This means a perfectly valid address can still fail inbox placement if the DKIM signature is present but not aligned with the sending domain — resulting in DKIM=neutral in DMARC reports. These tools see the address as “valid” and give you a green light, but they never test how the message will be interpreted by servers that enforce DMARC policies.

The gap: Verification vs. Alignment

Standard tools focus on syntax and delivery eligibility — does the mailbox exist? Can mail be delivered? They don’t simulate the actual cryptographic validation that happens during SMTP delivery. A DMARC policy relies on both SPF and DKIM alignment. If DKIM signs the message but isn’t aligned with the domain in the “From” header, the result is DKIM=neutral, which often leads to rejection or filtering, especially with strict policies.

It’s like sending a letter with a perfectly valid stamp and return address, but the envelope was sealed with a different sender's name. The postal service sees it, but flags it as suspicious. That’s exactly what happens with a DKIM=neutral result — the server sees the signature, but doesn’t trust it because it doesn’t match the sender domain.

Why this matters for deliverability

Many large email providers — including Google and Microsoft — use DMARC enforcement to block or filter unaligned messages. A single DKIM=neutral result in their reports doesn’t mean the message is delivered, but it does mean it’s at risk. If a high volume of your emails start showing neutral or fail results in DMARC reports, your sender reputation drops, and inbox placement suffers.

Standard tools don’t surface this risk because their output is limited to “valid,” “invalid,” or “risky.” They don’t report on alignment or policy outcome. That creates a blind spot: you’re not just cleaning your list — you’re cleaning a list that still fails real-world delivery checks.

You can test this in real time with tools that evaluate actual envelope and header behavior. MailTester’s inbox placement tests simulate delivery across major providers and show you where your message lands — including whether the DKIM signature passes alignment. Unlike most verification tools, we go beyond syntax to test how your email performs in live environments, so you don’t get burned by invisible DMARC failures.

MailTester identifies DKIM=neutral by verifying the cryptographic signature against the published public key, checking domain alignment, and flagging conflicts even when the signature is technically valid. This reveals hidden deliverability risks that simple validity checks miss — like misaligned domains or inconsistent policies — which can still cause inbox placement failures despite a valid signature.

Real-time DNS lookups and signature validation

Let’s break down how MailTester goes beyond basic checks. When you run a verification, our API performs a real-time DNS lookup to retrieve the DKIM public key published in the domain’s DNS records. This ensures we’re working with the current, authoritative key — not a cached or outdated one.

We then validate the DKIM signature’s cryptographic integrity using that key. If the signature fails this check, the address is flagged as invalid or insecure. But if it passes, we continue to assess policy alignment — because a valid signature alone doesn’t guarantee deliverability.

Domain alignment and the meaning of DKIM=neutral

The critical step most verifiers skip is checking domain alignment between the From: header in your email and the 'd=' tag in the DKIM signature. If these don’t match — even if the signature is valid — the result is DKIM=neutral in DMARC reports. This means the email passes authentication but fails policy validation.

MailTester detects this mismatch and reports it directly. You’ll see DKIM=neutral not as a "pass," but as a signal that your configuration may be failing DMARC policy checks, which affects inbox placement. For instance, if your From: domain is 'yourcompany.com' but the DKIM signature uses 'mail.yourcompany.com', DMARC will neutralize it, even if the key is correct.

According to the DMARC specification (RFC 7483), DKIM=neutral is a valid result when the signature is valid but the domain alignment doesn’t meet policy requirements. This is a common issue in multi-domain email setups or when using third-party sending platforms without proper alignment. Tools that only check if a signature is valid miss this entirely.

This visibility is why MailTester’s verification API and bulk verification tools are trusted by teams who manage large email lists. It catches risks before they cause hard bounces, spam folder placement, or sender reputation damage. You can verify your list at scale or test individual addresses using our bulk verification or email checker—both of which include deep DKIM and DMARC analysis.

Understanding DKIM=neutral isn't about spotting a flaw; it's about catching signals that email infrastructure is misaligned. With MailTester, you don’t just know if an address is valid—you know why it might be blocked, even if the signature checks out.

How to test for DKIM and DMARC alignment before sending

You can test DKIM and DMARC alignment by verifying your list with MailTester’s bulk verification and inbox-placement tools. Use the API to catch risky addresses early, analyze DMARC report alignment scores across domains, ensure all email channels use the same DKIM signing domain and selector, and monitor deliverability over time with recurring test sends and report reviews. This reduces bounces and inbox placement issues before real campaigns go live.

Run checks across your email ecosystem

  • Use MailTester’s inbox-placement testing to simulate delivery to Gmail, Outlook, and Yahoo—each uses different spam filters and alignment rules, so testing real provider behavior is critical.
  • Run a bulk verification with the MailTester email list verify tool, filtering results for DKIM-related flags such as dkim=neutral or alignment mismatch. These indicate potential deliverability risks even if the address is valid.
  • Check the DMARC report alignment score for every domain in your email ecosystem, including third-party senders. A low alignment score means SPF or DKIM signs a domain that doesn’t match the “From” domain, which harms reputation and increases filtering.
  • Ensure all email channels—marketing, transactional, CRM—sign emails with the same DKIM domain and selector. Mixing domains (e.g., sending from [email protected] with selector1._domainkey.sendgrid.net) breaks alignment and triggers spam filters.
  • Review DMARC reports (from providers like Google or Microsoft) and look for dkim=neutral or spf=neutral results. These don’t mean the email is invalid, but they signal that the alignment test didn’t pass, which can degrade inbox placement.

Monitor and maintain alignment over time

  • Set up a recurring test send cadence—weekly or monthly—using MailTester’s inbox tester to catch shifts in filtering behavior before they impact real campaigns.
  • Analyze the results by checking both delivery and alignment outcomes. Even if an address passes verification, a recent shift in the DKIM or SPF policy could cause neutral status in reports.
  • Use the MailTester verification API to integrate alignment checks into your send workflow. Automate alerts when an address shows DKIM or DMARC warnings during validation.
  • Document and track which domains are used for signing and ensure they’re consistently published in DNS with updated records. Misconfigured or outdated TXT records are a common source of neutral results.
  • Refer to the RFC 7672 and RFC 7483 standards for the technical definition of DKIM and DMARC alignment—alignment is defined by the domain matching between the “From” header and the domains in the DKIM and SPF signatures.
Alignment isn’t about whether an email is valid—it’s about whether it appears to come from the domain it claims. A neutral or failed alignment flag can cause rejection, even with a valid address.

DMARC policies and what DKIM=neutral implies

When DMARC reports show dkim=neutral, it means the DKIM signature passed cryptographic validation but didn’t align with the From: domain. A policy of p=none ignores this, but p=quarantine or p=reject count it as a failure, lowering inbox placement. Even with valid crypto, misalignment breaks the alignment rule — that’s why neutral verdicts hurt deliverability.

How DMARC policies interpret DKIM=neutral

Under a p=none policy, neutral DKIM results don’t trigger any action. They’re logged, but messages still deliver. This is common during testing or when email volume is low. But if your policy is p=quarantine or p=reject, even a valid DKIM signature with dkim=neutral counts as a failure — and that harms your sender reputation.

Let’s break that down: DKIM validates the message hasn’t been altered in transit, but it doesn’t verify who sent it. Alignment checks whether the domain in the DKIM signature matches the From: domain. If not — even if the signature is valid — DMARC marks it as neutral. This happens often with forwarded emails, third-party senders, or misconfigured mailers.

Why alignment matters more than crypto

Having a valid cryptographic signature is not enough. DMARC relies on alignment to prevent spoofing. The sender's domain must match the one in the DKIM signature (or SPF) for the result to pass. When it doesn’t, you get dkim=neutral, regardless of encryption strength.

This is why many high-volume senders see spikes in neutral results after enabling DMARC. They’re not necessarily broken — but they’re not fully aligned. For example, when using a transactional email service, the signing domain may be senderservice.com, but the From: domain is yourcompany.com. The result is alignment failure — even if the encryption is flawless.

DMARC reports from tools like DMARC Analyzer or Spamhaus will flag such issues. That’s where real-time verification helps. You can test email delivery before sending — and catch alignment issues early.

For example, if you send from a service like SendGrid but use your own domain in From:, you need to ensure that your DKIM selector and domain match the intended sending source. Tools like MailTester’s bulk verification check not just validity, but also whether DKIM alignment is intact across your list.

Ultimately, your sender reputation isn’t just about hitting the inbox — it’s about consistent conformance. Neutral results under strict DMARC policies don’t just log failure; they build trust gaps. Fix alignment, verify before sending, and keep your deliverability rate stable.

The hidden cost of ignoring DKIM=neutral results

Even if an email passes basic validation, a DKIM=neutral result means the message’s signature wasn’t verified, which can trigger spam filters at major providers like Gmail and Yahoo. This silently blocks delivery to inboxes, reduces engagement, and erodes sender reputation over time—driving up bounce rates and lowering campaign ROI, even when your list is technically valid.

Neutral results aren’t neutral in practice

DKIM=neutral doesn’t mean the email is invalid—it means the signature couldn’t be validated. This can happen due to misconfigured keys, expired certificates, or a missing signature altogether. But even if the address itself is correct, neutral results often trigger filters that treat the message as untrusted.

Let’s say you send to 10,000 valid addresses, and 600 of them show DKIM=neutral. Those 600 may never reach inboxes, even though they’re real. That’s wasted sends, broken engagement metrics, and invisible campaign failure.

How neutral violations hurt long-term deliverability

Major providers like Return Path and Google’s Postmaster Tools track consistency in authentication. Repeated DKIM=neutral findings—especially across large volumes—signal poor infrastructure hygiene. Over time, this damages reputation scores, which directly impact inbox placement. The same email that lands in a user's inbox today might be tagged as spam tomorrow.

Spam complaints and feedback loops rise when delivery is inconsistent. Recipients don’t notice when some emails arrive and others vanish. But their inboxes start to filter entire campaigns without warning—which feeds into algorithmic distrust.

According to the RFC 7050, authentication failures like DKIM=neutral must be treated with scrutiny. It’s not just about technical correctness—it’s about trust. Ignoring them treats a system warning as background noise, but that noise accumulates.

Fixing this doesn’t require complex changes. Start with verifying your list and tracking authentication status. Use a service like MailTester’s bulk email verification to identify and filter out high-risk addresses before sending—including those with neutral authentication signals. Catching these early prevents reputation damage and keeps your campaigns visible.

How to stay ahead of DKIM and DMARC issues

DKIM=neutral in DMARC reports often means a signature is present but not aligned. This doesn’t always break delivery, but it signals a risk — especially if it appears consistently across domains or messages.

Regular audits catch these issues early. Signature mismatches, missing keys, or incorrect selectors can go unnoticed without proactive checks. Quarterly reviews ensure your SPF, DKIM, and DMARC configurations remain aligned and enforceable.

Proactive steps to maintain alignment

  • Audit your email infrastructure every quarter for signature mismatches and alignment gaps.
  • Use real-time verification tools like MailTester to detect and fix alignment issues before messages are sent.
  • Integrate the MailTester API into your sending workflow to validate domains and signatures at scale.
  • Monitor DMARC reports across all domains for recurring neutral results — an early sign of misconfiguration.
  • Use the in-app AI assistant to interpret report data and generate actionable suggestions to correct alignment failures.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can a valid DKIM signature still result in DKIM=neutral?

Yes — a DKIM signature can pass cryptographic checks but still be marked as neutral if the domain or selector doesn’t align with the From: address or DMARC policy.

Does DKIM=neutral mean the email was not signed?

No — DKIM=neutral means the signature was present and cryptographically valid, but the receiving server couldn’t accept it due to policy or alignment issues.

Can DKIM=neutral cause an email to land in spam?

Yes — DMARC-compliant receivers may treat DKIM=neutral as a failure, especially under quarantine or reject policies, leading to spam placement.

How can I tell if my DKIM setup is correct?

Check that the 'd=' tag in the DKIM-Signature header matches the From: domain, and that the selector matches the DNS TXT record.

Do all email verification tools test DKIM?

No — most only check syntax and delivery eligibility. Few validate cryptographic alignment or detect DKIM=neutral outcomes.

What’s the difference between DKIM=neutral and DKIM=fail?

DKIM=fail means the signature failed cryptographic validation. DKIM=neutral means it passed but the domain alignment or policy conflict caused rejection.

How does MailTester help with DKIM issues?

MailTester verifies DKIM signatures in real-time, checks domain alignment, and flags DKIM=neutral outcomes — even if the email address is valid.

Can a legitimate email still be rejected due to DKIM=neutral?

Yes — if the signing domain doesn’t match the From: domain or the selector is misconfigured, even valid emails can be rejected by strict receivers.

Why should I care about DKIM=neutral if my emails deliver?

Because delivery doesn’t guarantee inbox placement. Persistent neutral results degrade sender reputation over time and can lead to filtering.

Is DKIM=neutral a sign of a security issue?

Not necessarily — it’s a policy or configuration issue. But if left unaddressed, it can make your messages vulnerable to impersonation or rejection.

How often should I test my DKIM setup?

At least quarterly, and after any email infrastructure changes. Use tools like MailTester to test before large sends.

Can I test sender reputation directly?

You can assess reputation via DMARC reports and inbox placement tests. Real-time tools like MailTester evaluate sender health through multiple signals.