Why DMARC having DKIM failure?

mfoley · 08-27-2022, 01:51 PM

I have enable DMARC feedback for my server. I am getting the following messages, in this case from google, but I've gotten similar from att.net and others:

Code:

Email Provider: google.com
Report Id: 7844382628123659573
Report Start Date:  2022-08-25 20:00:00
Report End Date:  2022-08-26 19:59:59
Domain: mercureytech.com
<adkim> DKIM Alignment: r Relaxed
<aspf> SPF Alignment: r Relaxed
<p> Public Key: none
<sp> Subdomain Policy: none
<pct> Policy Applies: 100%
Source IP: 24.142.169.11
Email Volume: 1
Policy Disposition: none
DKIM Disposition: fail
SPF Disposition: pass
Header From: mercureytech.com 
DKIM Auth. Domain: mercureytech.com
DKIM Results: fail
DKIM Selector: mercmail
SPF Auth. Domain: mercureytech.com

Note the "DKIM Disposition: fail" and "DKIM Results: fail". Why am I getting this? Third party tools such as dmarcanalyzer.com and others indicate a valid DKIM record and if I examine headers from this domain it says "dkim=pass (1024-bit key) header.d=mercureytech.com header.i=@mercureytech.com"

So why the DKIM failures being reported on the DMARC reports from these service providers?

elgrandeperro · 08-28-2022, 12:04 PM

I think it might be p=none. You could do p=quarantine and see if that works.

mfoley · 09-05-2022, 08:58 AM

Quote:

Originally Posted by elgrandeperro

I think it might be p=none. You could do p=quarantine and see if that works.

I'm not following you. 'p' is "public key". setting that to "quarantine" doesn't seem right.

elgrandeperro · 09-05-2022, 09:28 AM

dmarc not dkim. Some tools flag that (policy disposition) as a warning, but this might be more strict.