MailFixIt

Cisco Secure Email setup

Cisco Secure Email: DKIM signature is missing or fails

The DNS key, signing profile, or outbound mail policy may not match the domain and selector in the message.

Problem description

The visible symptom is:

Authentication-Results: dkim=fail header.d=example.com

Check the sending domain

Fix DKIM signing

  1. In AsyncOS, open the DKIM signing profile used for outbound mail.
  2. Confirm its signing domain and selector match the intended From domain.
  3. Copy the public key from that profile to selector._domainkey.example.com in public DNS.
  4. Make sure the outbound mail flow policy uses the signing profile.
  5. Check the public key by domain and selector.
  6. Send a new message and confirm that it contains a DKIM-Signature and returns dkim=pass.

Common causes

The key is published under the wrong selector, DNS contains an old key, the profile is not attached to the outbound policy, or another system changes signed content after Cisco signs it.

What the check proves

MailFixIt can validate the public selector and key. Only a new message can prove that Cisco used the matching private key and that the signature survived delivery.

Frequently asked questions

Why is Cisco Secure Email not adding DKIM?

A signing profile is not enough by itself. It must be enabled for the outbound mail flow policy that handles the message.

Does a correct DNS record prove the gateway is using it?

No. The gateway must also enable the matching route, signing profile, or policy. Confirm the result in a new message header.

Related email diagnostics

DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key. Cisco Secure Email: SPF fails for outbound mailFix SPF failure for mail sent through Cisco Secure Email Cloud Gateway or a managed appliance. DMARC policy for the visible From subdomain is unexpectedFind the effective DMARC policy for a visible From subdomain. See whether p, sp, np or test mode applies before changing DMARC DNS.

Primary sources: Cisco Secure Email Gateway AsyncOS 16.0 user guide.