MailFixIt

Mimecast Cloud Gateway setup

Mimecast: DKIM signature is missing or fails

The outbound signing definition, DNS selector, or active policy may not match the message's From domain.

Problem description

The visible symptom is:

Authentication-Results: dkim=fail header.d=example.com

Check the sending domain

Fix DKIM signing

  1. In Mimecast, open or create an outbound DNS Authentication signing definition.
  2. Select the exact internal domain and a 2048-bit key where supported.
  3. Copy Mimecast’s DNS Address and Public Key exactly into a TXT record.
  4. If your DNS panel adds the domain automatically, enter only the host portion of the DNS Address.
  5. Use Check DNS in Mimecast, then save the definition.
  6. Enable an outbound DNS Authentication policy that uses that definition.
  7. Send a new message and confirm dkim=pass with the expected d= domain and selector.

Common causes

The DNS panel duplicated the domain name, the key text was altered, the definition was validated but not saved, the outbound policy is missing, or another service changes the message after signing.

What the check proves

MailFixIt can validate the public key. A new message proves whether Mimecast signed with the matching private key.

Frequently asked questions

Why does Mimecast find the DKIM key but still not sign?

After the DNS check succeeds, the definition must be saved and an outbound DNS Authentication policy must use it.

Does a correct DNS record prove the provider is using it?

No. The provider must also activate the matching route or signing policy. Confirm the result in its console and in a new message.

Related email diagnostics

DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key. Mimecast: SPF fails for outbound mailFix SPF failure when Mimecast Cloud Gateway sends outbound mail for your domain. DMARC policy for the visible From subdomain is unexpectedFind the effective DMARC policy for a visible From subdomain. See whether p, sp, np or test mode applies before changing DMARC DNS.

Primary sources: Mimecast: configure an outbound DNS Authentication definition.