This message typically indicates that an email contains a DKIM (DomainKeys Identified Mail) or DK signature, but the signature validation failed or has not been verified. A valid DKIM signature is critical for email authentication, ensuring the email has not been altered during transmission.

What is DKIM?

DKIM is an email authentication method that:

  • Adds a digital signature to the email header.
  • Allows the recipient email server to verify the authenticity of the email using the sender public key (published in DNS records).
  • Ensures that the email has not been tampered with during transmission.

Why Does This Message Appear?

Incorrect DKIM Setup

The DKIM DNS record is missing or misconfigured.

Mismatched Signing Domain

The DKIM signing domain does not match the sender domain.

Altered Email Content

The email was modified in transit (e.g., by a forwarding server).

Public Key Not Found

The recipient mail server cannot locate the public DKIM key in the DNS records.

Expired DKIM Key

The DKIM key has expired or been replaced without updating the DNS record.

Verify the DKIM DNS Record

  1. Locate the selector used in your email:
    • Look for s= in the DKIM-Signature header.
  2. Use a DNS lookup tool (e.g., MXToolbox DKIM Lookup) to verify the record.
  3. Ensure the DKIM record exists and is properly formatted:
    v=DKIM1; k=rsa; p=YOUR_PUBLIC_KEY

Check Email Headers for DKIM Status

  1. Analyze the email headers:
    • In Gmail, click on "Show original" to view the full headers.
    • Look for a line like:
    Authentication-Results: dkim=fail (body hash did not verify)
  2. Verify the DKIM result:
    • dkim=pass: DKIM is valid.
    • dkim=fail: Signature mismatch or key issues.
    • dkim=neutral: No validation attempted.

Ensure the Email Content Is Not Altered

  1. Email Forwarding:
    • Forwarding services may modify headers or the message body, invalidating the DKIM signature.
    • Use SPF and DMARC for additional validation to mitigate forwarding issues.
  2. Check Email Encoding:
    • Ensure proper encoding (e.g., UTF-8) for email content.

Generate a New DKIM Key (If Necessary)

  1. Generate a new 2048-bit DKIM key using your mail server or a tool.
  2. Update your DNS TXT record with the new public key.
  3. Update your mail server configuration with the new private key.

Testing Your DKIM Setup

  1. Send a test email to a DKIM validation service:
  2. Review the results to ensure the signature is valid.

Implementing DMARC for Additional Protection

  1. Add a DMARC record to your DNS:
    _dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:reports@yourdomain.com"
  2. This enforces DKIM and SPF policies and provides detailed reports on email authentication.

Summary

To fix the "not necessarily valid" DKIM issue:

  1. Verify your DKIM DNS record and mail server configuration.
  2. Ensure no email content is altered in transit.
  3. Use tools like Mail Tester to test your setup.