Home · Troubleshoot · Body hash

DKIM · body hash

DKIM signature body hash did not verify

22 October 2026

DKIM binds a hash of the body (bh=) and selected headers. If anything changes the body after signing—disclaimers, URL rewriting, virus scanners that alter MIME, encoding fixes—the body hash fails even though the DNS key is correct.

Isolate the break

1. Capture the message immediately after the signing MTA (before the gateway) and again after the gateway.
2. Compare Content-Type boundaries, transferred encodings, and inserted footers.
3. Check whether l= (canonicalized body length) was used; some gateways append data past l= and still verify—others modify bytes inside the signed region.
4. Confirm the DNS key at s=._domainkey matches the signer (audit the selector on the free audit). A wrong key presents as signature failure, not specifically “body hash”.
5. Disable one rewriter at a time: link tracking, encryption portals that wrap HTML, signature banners on outbound mail.

Stable patterns

• Sign after the last body mutation on outbound paths you control.
• Prefer ESP-native link branding that is applied before DKIM.
• ARC can help receivers trust forwarded mail; it does not repair a broken original signature for DMARC alignment of the From domain.

DMARC needs at least one aligned passing SPF or DKIM result. A broken body hash means DKIM does not contribute; SPF alignment must then carry the message—or the message fails DMARC under quarantine/reject.