Mail errors · SPF, DKIM and DMARC results

What does “PERMFAIL (body hash did not verify)” mean?

The body of the message changed after it was signed, so the DKIM signature no longer matches.

Last read from the sources at the foot of this page.

Check my firm Read the steps
Result
DKIM check

PERMFAIL (body hash did not verify)

As the standard prints it.
01

What does it mean?

DKIM signs a fingerprint of the message body. Any change after signing, even one added line, breaks it.

02

What exactly does the source say?

If the hash does not match, the Verifier SHOULD ignore the signature and return PERMFAIL (body hash did not verify).

03

Why would a small firm see it?

A footer or disclaimer added by a separate filter service, a mailing list that edits messages, or a forward that rewrites them.

04

How do I fix it?

  1. Look at the message as received and compare it with what was sent.
  2. Find the service that added the change.
  3. Have that service sign with your domain after its change, or add the footer before the message is signed.
05

What else do the sources say?

dkim=<pass|fail (reason)|none> header.d=<domain>

fail (reason): Indicates the DKIM check for the message failed and why. For example, if the message wasn't signed or the signature wasn't verified.

Sources

Where does this come from?

Related
07 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy