MailFixIt

SpamExperts setup

SpamExperts: DKIM signature is missing or fails

The generated key, public selector record, or outgoing user's selector may not match.

Problem description

The visible symptom is:

Authentication-Results: dkim=fail header.d=example.com

Check the sending domain

Fix DKIM signing

  1. Confirm whether the original mail server already adds a valid DKIM signature.
  2. If SpamExperts should sign, open Outgoing > DKIM and generate a 2048-bit key when your DNS supports it.
  3. Publish the shown public key at selector._domainkey.example.com.
  4. Open Outgoing > Manage Outgoing Users/Authentication.
  5. Assign that same selector to the outgoing user.
  6. Send a new message through the outbound filter and confirm dkim=pass.

Common causes

The DNS selector differs from the outgoing user setting, the key was changed while an old value is cached, the message bypasses SpamExperts, or a later system changes signed content.

What the check proves

MailFixIt can validate the public key. A new header proves whether SpamExperts used the matching private key.

Frequently asked questions

Why does SpamExperts not add a DKIM signature?

The outgoing user or authentication method must use the same selector as the generated key. A key in DNS alone does not enable signing.

Should I replace an existing DKIM signer?

No. If the original mail system already signs and SpamExperts preserves the signature, keep that working path. Add SpamExperts signing only when it owns the outbound signing step.

Related email diagnostics

DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key. SpamExperts: SPF fails for outbound filtered mailFix SPF failure for outbound mail sent through SpamExperts Hosted Cloud or Local Cloud. DMARC policy for the visible From subdomain is unexpectedFind the effective DMARC policy for a visible From subdomain. See whether p, sp, np or test mode applies before changing DMARC DNS.

Primary sources: SpamExperts: set up DKIM.