DKIM fails due to body hash

Products

• Messaging Gateway

Issue/Introduction

You are seeing that email transactions are failing DKIM validation due to the body hash.

Cause

The body hash is a hash snapshot of the raw SMTP message body, not including top level header data, that is to be delivered to the next mail server. If something in the message body is changed, including additions or removals, then the body hash validation will fail.

Resolution

You must review your mail flow for anything that might change the message body between the sending/signing mail server and the receiving mail server that is reporting the validation failure.

For messages sent through the Messaging Gateway, if the change is due to a valid interim mail service you can either disable the features that caused the change, or move where the DKIM signing occurs. There should be no changes to the message body after DKIM signing.

For messages received by the Messaging Gateway, you should let the sending mail admins know that their DKIM signing is failing validation, so they can do their own investigations to correct the issue.

Additional Information

More information on DKIM signing is available here:
https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail#Signing

The calculations for body hash are documented in sections 3.4.3 and 3.4.4 of the DKIM Signatures RFC:
https://datatracker.ietf.org/doc/html/rfc6376#section-3.4.3