MailFixIt

STRATO Mail email configuration guide

STRATO Mail: DKIM signature not passing

The correct DKIM fix depends on whether the message was sent through STRATO SMTP or through a separate website, newsletter, or application provider.

Problem description

A provider setup symptom may look like:

A message sent as the STRATO-hosted domain does not show a passing DKIM signature.

Check the sending domain

What this usually means

STRATO states that mail sent through its own smtp.strato.de service is already DKIM-signed. A missing or failed signature often means the message came from another sender, or you checked a selector different from the one in the message.

Fix it

  1. Inspect the raw message and record the sending route plus the DKIM d= domain and s= selector.
  2. If STRATO SMTP sent it, confirm the account and From domain are configured correctly and ask STRATO support about a missing provider signature.
  3. If a website, CRM, newsletter tool, or other provider sent it, obtain the DKIM record from that provider.
  4. Publish the exact record at selector._domainkey.domain without a duplicated suffix, truncated key, or wrong CNAME/TXT type.
  5. Send a new message through the same service and confirm dkim=pass.

Common mistake

Creating an arbitrary custom DKIM key cannot make STRATO or a third-party platform use its matching private key. The sender must own the private key and sign the message.

What MailFixIt can check

MailFixIt can inspect the public key for the selector found in a message. It cannot determine private provider activation from DNS alone.

Use the related DKIM guide when the message selector is missing or its public record is invalid.

Frequently asked questions

What does MailFixIt check for STRATO Mail?

It can query the selector found in a message header. STRATO account state and the actual outbound route must be confirmed separately.

Should I replace every existing DNS record with the provider values?

No. Confirm the exact record type and owner, preserve unrelated legitimate services, and change only the provider-controlled record required for the intended mail route.

Related email diagnostics

Email delivery delayed or rejected after a DNS migrationDiagnose email that stopped arriving after a DNS change. Compare public MX records with the intended provider and avoid false alarms for mail gateways. SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely. DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key.

Primary sources: STRATO Mail official setup guidance.