SpamAssassin rule
DKIM_INVALID
DKIM signature is invalid
+0.1 points
Combination of other tests (meta rule)
What DKIM_INVALID means
The message has a DKIM signature, but it does not verify. Either the public key in DNS does not match, or the message was changed after signing (often by a footer added by a relay or mailing list).
The rule's description in SpamAssassin: “DKIM or DK signature exists, but is not valid”
How to fix it
Check the selector with the DKIM checker, make sure the published key is the one your service signs with, and avoid tools that modify messages after they are signed.
Does your email trigger DKIM_INVALID?
Send it to a free test address: we run SpamAssassin, check SPF, DKIM and DMARC and show every rule with a fix.
Open the email spam checkerRelated rules
ARC_INVALIDARC signature is invalid
DKIM_ADSP_ALLDomain says it signs all mail, but this message is unsigned
DKIM_ADSP_DISCARDDomain asks to discard unsigned mail
DKIM_ADSP_NXDOMAINFrom domain does not exist
DKIM_SIGNEDMessage is DKIM-signed
DKIM_VALIDValid DKIM signature
DKIM_VALID_AUDKIM signature from your own domain
DKIM_VALID_EFDKIM signature from the envelope sender's domain
DMARC_MISSINGNo DMARC record
Frequently asked questions
What does DKIM_INVALID mean?
The message has a DKIM signature, but it does not verify. Either the public key in DNS does not match, or the message was changed after signing (often by a footer added by a relay or mailing list).
How do I fix DKIM_INVALID?
Check the selector with the DKIM checker, make sure the published key is the one your service signs with, and avoid tools that modify messages after they are signed.
How many points does DKIM_INVALID add?
0.1 points in the default SpamAssassin ruleset (network tests on, Bayes off). A message is treated as spam from 5.0 points. Mail servers can change scores locally.