How to Diagnose DKIM Failures After an NS Migration
📝 Originally published (in Japanese) at forge.workstyle.tech . TL;DR After an NS migration, mail was delivered but DKIM failed four days later. SPF passed, and the DMARC policy was p=none . Comparing all records with dig showed that the new DNS was missing one DKIM TXT record. TL;DR After migrating nameservers, DKIM was failing because the new DNS was missing a TXT record used by the mail server…
Four days after migrating nameservers, DKIM was failing despite SPF passing and DMARC set to p=none. Comparing all DNS records with dig revealed that the new DNS was missing a DKIM TXT record for the mail server. SPF passing didn't alert me to the missing DKIM record, and I hadn't checked how many DKIM checks had failed. After adding the missing TXT record and running a sending test, DKIM passed.
The value was 408 characters long and matched exactly. The mistake was easy to miss when there are many records to check. If you think you've checked every record, it's easy to overlook one. Even if emails are getting through, that doesn't mean there isn't a problem. Diff all DNS records in the old and new DNS before and after an NS migration, and be sure to check for the DKIM TXT record when the new DNS is live.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
