DKIM Body Hash Validation Shows as Fail in Third-Party Tools (e.g., MXToolbox)

Products

• Messaging Gateway

Issue/Introduction

When copy and paste an email header into third-party testing tools such as MXToolbox, the tool may report that the DKIM body hash fails.

This often leads to confusion when the recipient’s mail server (e.g., Gmail, Outlook, etc.) shows DKIM validation as pass.

Environment

SMG 10.8 10.9

Cause

Third-party tools like MXToolbox recalculate the body hash based on the message content provided by the user.

If the pasted email header or body is modified in any way (extra line breaks, missing body content, altered whitespace, encoding changes), the hash computed by the tool will not match the original DKIM signature.

As a result, the third-party tool incorrectly reports DKIM body hash mismatch even though the actual recipient mail server validated it correctly.

Resolution

To determine the true DKIM validation result, always check the Authentication-Results header added by the receiving mail server (e.g., Gmail, Office 365, etc.).

This header shows whether the DKIM verification passed or failed based on the message as it was actually received.

 

Use the Authentication-Results header from the recipient mail system as the source of truth for DKIM/SPF/DMARC validation, rather than relying solely on third-party parsing tools.