The DKIM temperror (short for "temporary error") indicates that a recipient mail server encountered an issue when trying to validate the DKIM signature of an email. This is typically due to a temporary issue with retrieving or processing the DKIM DNS records for the sender domain.

What Causes DKIM Temperror?

DNS Propagation Issues

If the DKIM record was recently added or updated, it may not have propagated fully across DNS servers yet.

Temporary DNS Failures

The recipient server might be unable to resolve the DNS for the sender DKIM public key due to network or DNS resolver issues.

Misconfigured DKIM Records

Incorrect or incomplete DKIM TXT records in the sender DNS zone can lead to validation errors.

Overloaded or Slow DNS Server

The sender DNS server might be experiencing high traffic or delays, causing timeouts when queried for DKIM records.

Malformed DKIM Key

The DKIM public key published in the sender DNS may have errors, such as missing characters, extra spaces, or improper formatting.

How to Resolve DKIM Temperror

Verify the DKIM Record

  • Check the DNS TXT record for DKIM to ensure it is properly configured.
  • Example DKIM record format:
default._domainkey.example.com IN TXT "v=DKIM1; k=rsa; p=PUBLIC_KEY"
  • Replace:
  • default with the correct selector.
  • example.com with the sender domain.
  • PUBLIC_KEY with the actual DKIM public key.
  • Use online tools like MXToolbox DKIM Lookup or run the following command:
dig TXT default._domainkey.example.com

Ensure the DKIM record resolves correctly.

Check DNS Propagation

  • If the DKIM record was recently created or modified, wait up to 24-48 hours for DNS changes to propagate globally.
  • Test DNS resolution using public DNS servers like Google (8.8.8.8):
dig @8.8.8.8 TXT default._domainkey.example.com

Verify DNS Server Availability

  • Ensure that your DNS server is responding correctly and not experiencing timeouts or high load.
  • Check DNS logs or monitor server performance for signs of overloading.

Use Correct DKIM Selector

  • Verify that the selector in the DKIM signature matches the DNS record.
  • Example from the email header:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=default;
  • Ensure the selector (s=default) corresponds to the DNS record (default._domainkey.example.com).

Check for Malformed DKIM Records

  • Common formatting issues:
    • Missing or extra spaces in the DKIM public key.
    • Missing double quotes around the key.
    • Line breaks that are not properly escaped.
  • Example of a valid DKIM record:
"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAn..."

Increase DNS Timeout

  • If the issue is related to slow DNS response, increase the timeout on the recipient mail server.
  • Example for Postfix: Add the following to main.cf:
smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination, reject_unknown_sender_domain, reject_unknown_recipient_domain
resolver_timeout = 5s

Check Server Logs

  • Review mail server logs for detailed error messages. These logs often provide clues to the specific cause of the temperror.
  • Postfix:
    • sudo tail -f /var/log/mail.log
  • Exim:
    • sudo tail -f /var/log/exim_mainlog

Prevent Future DKIM Temperrors

Monitor DNS Health

Regularly check the health and availability of your DNS servers.

Use Redundant DNS Providers

Use multiple DNS providers (e.g., Cloudflare, Google DNS) to avoid single points of failure.

Implement SPF and DMARC

Ensure your domain also has proper SPF and DMARC records to enhance email authentication and improve deliverability.

Example SPF record:

v=spf1 include:_spf.google.com -all

Example DMARC record:

_dmarc.example.com IN TXT "v=DMARC1; p=none; rua=mailto:postmaster@example.com"

Use a Reputable Email Provider

Providers like Google Workspace, Microsoft 365, and Amazon SES automatically handle DKIM and related DNS records.

Testing Tools

  1. Mail Tester: Use Mail Tester to verify DKIM, SPF, and DMARC settings.
  2. MXToolbox DKIM Validator: Validate your DKIM configuration: MXToolbox DKIM Lookup.
  3. Command-Line Tools: Use dig or nslookup to manually query DNS records.

To resolve a DKIM temperror, focus on:

  1. Verifying and correctly configuring the DKIM DNS record.
  2. Ensuring DNS servers are accessible and performant.
  3. Matching the DKIM selector in your DNS to the one used in your email headers.