Documentation / Authentication & DNS

DKIM Body Hash Mismatch

Evidence-first troubleshooting runbook for dkim body hash mismatch.

v2.6Updated 2026-07-20Production guidance

Production note: DNS and authentication changes should be staged, validated with independent resolvers, and rolled out with a documented rollback path.

Symptom

Record the exact Authentication-Results line, DNS response, timestamp, source IP, envelope sender, visible From domain, and DKIM selector before changing anything.

Immediate triage

Stop related DNS changes.
Compare authoritative and recursive answers.
Inspect one raw delivered or rejected message.
Identify whether the failure is DNS, signing, identity, or caching.

Evidence commands

dig +trace example.com
dig @1.1.1.1 TXT _dmarc.example.com
dig @8.8.8.8 TXT selector1._domainkey.example.com
opendkim-testkey -d example.com -s selector1 -vvv

Recovery sequence

Correct one layer, wait for the applicable TTL, send controlled tests, and verify the final provider result before restoring normal traffic.

Prevention

Version-control DNS records.
Monitor selectors and policy records.
Use staged TTL changes.
Maintain a sender inventory.
Run pre-deployment authentication tests.