---
title: "Does DKIM break for forwarded emails and mailing lists? | DMARC Report"
description: "Does DKIM break for forwarded emails and mailing lists? from DMARC Report explains practical steps for email authentication, domain protection."
image: "https://dmarcreport.com/og/blog/does-dkim-break-for-forwarded-emails-and-mailing-lists.png"
canonical: "https://dmarcreport.com/blog/does-dkim-break-for-forwarded-emails-and-mailing-lists/"
---

Quick Answer

DKIM (RFC 6376) signs email messages cryptographically, and unlike SPF, the signature survives email forwarding - which is why DMARC alignment via DKIM is more reliable than SPF alignment for forwarded mail. DMARC Report Does DKIM break for forwarded emails and mailing lists?

Related: [Free DMARC Checker](/tools/dmarc-checker/) 

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fdoes-dkim-break-for-forwarded-emails-and-mailing-lists%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Does%20DKIM%20break%20for%20forwarded%20emails%20and%20mailing%20lists%3F&url=undefined%2Fblog%2Fdoes-dkim-break-for-forwarded-emails-and-mailing-lists%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fdoes-dkim-break-for-forwarded-emails-and-mailing-lists%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fdoes-dkim-break-for-forwarded-emails-and-mailing-lists%2F&title=Does%20DKIM%20break%20for%20forwarded%20emails%20and%20mailing%20lists%3F "Share on Reddit") [ ](mailto:?subject=Does%20DKIM%20break%20for%20forwarded%20emails%20and%20mailing%20lists%3F&body=Check out this article: undefined%2Fblog%2Fdoes-dkim-break-for-forwarded-emails-and-mailing-lists%2F "Share via Email") 

![Does DKIM break for forwarded emails and mailing lists?](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-record-6071.jpg) 

## Try Our Free DKIM Lookup

Auto-discover DKIM selectors for any domain - scan 185 common selectors across all major providers.

[ Discover DKIM Selectors → ](/tools/dkim-lookup/) 

![Dmarc check 1 150x150](https://media.mailhop.org/dmarcreport/images/2024/07/dmarc-check-1-150x150.jpg) 

> Email authentication isn’t just about preventing spoofing - it’s about trust, says Vasile Diaconu, Operations Lead at DuoCircle. Every email your organization sends either builds trust or erodes it. SPF, DKIM, and DMARC are the foundation of that trust. Without them, receivers have no way to distinguish your legitimate email from an attacker’s.

DKIM ([RFC 6376](https://datatracker.ietf.org/doc/html/rfc6376)) signs email messages cryptographically, and unlike SPF, the signature survives email forwarding - which is why DMARC alignment via DKIM is more reliable than SPF alignment for forwarded mail. DMARC Report

Does DKIM break for forwarded emails and mailing lists?

```
					<button title="Play" aria-label="Play Episode" aria-pressed="false" class="play-btn">
						
```

Play Episode

```
					</button>
					<button title="Pause" aria-label="Pause Episode" aria-pressed="false" class="pause-btn hide">
						
```

Pause Episode

```
					</button>
				

					<audio preload="none" class="clip clip-14341">
						<source src="https://media.mailhop.org/dmarcreport/images/2024/07/Does-DKIM-Break-For-Forwarded-Emails-And-Mailing-Lists.mp3">
					</audio>
						

							<button class="player-btn player-btn__volume" title="Mute/Unmute">
								
```

Mute/Unmute Episode

```
							</button>
							<button data-skip="-10" class="player-btn player-btn__rwd" title="Rewind 10 seconds">
								
```

Rewind 10 Seconds

```
							</button>
							<button data-speed="1" class="player-btn player-btn__speed" title="Playback Speed" aria-label="Playback Speed">1x</button>
							<button data-skip="30" class="player-btn player-btn__fwd" title="Fast Forward 30 seconds">
								
```

Fast Forward 30 seconds

```
							</button>
						

							<time class="ssp-timer">00:00</time>
							
```

/

```
							<!-- We need actual duration here from the server -->
							<time class="ssp-duration" datetime="PT0H2M1S">2:01</time>
			

								<nav class="player-panels-nav">
												<button class="subscribe-btn" id="subscribe-btn-14341" title="Subscribe">Subscribe</button>
																		<button class="share-btn" id="share-btn-14341" title="Share">Share</button>
										</nav>

						
```

RSS Feed

```
							<input value="https://dmarcreport.com/feed/podcast/dmarc-report" class="input-rss input-rss-14341" title="RSS Feed URL" readonly />
						

						<button class="copy-rss copy-rss-14341" title="Copy RSS Feed URL" aria-label="Copy RSS Feed URL"></button>
					

						Share						
					

						<a href="https://www.facebook.com/sharer/sharer.php?u=https://dmarcreport.com/blog/podcast/does-dkim-break-for-forwarded-emails-and-mailing-lists/&t=Does DKIM break for forwarded emails and mailing lists?" target="blank" rel="noopener noreferrer" class="share-icon facebook" title="Share on Facebook">
							

						</a>
						<a href="https://twitter.com/intent/tweet?text=https://dmarcreport.com/blog/podcast/does-dkim-break-for-forwarded-emails-and-mailing-lists/&url=Does DKIM break for forwarded emails and mailing lists?" target="blank" rel="noopener noreferrer" class="share-icon twitter" title="Share on Twitter">
							

						</a>
						<a href="https://media.mailhop.org/dmarcreport/images/2024/07/Does-DKIM-Break-For-Forwarded-Emails-And-Mailing-Lists.mp3" target="blank" rel="noopener noreferrer" class="share-icon download" title="Download" download>
							

						</a>
					

						Link						
					

						<input value="https://dmarcreport.com/blog/podcast/does-dkim-break-for-forwarded-emails-and-mailing-lists/" class="input-link input-link-14341" title="Episode URL" readonly />
					

					<button class="copy-link copy-link-14341" title="Copy Episode URL" aria-label="Copy Episode URL" readonly=""></button>
					

						Embed						

					
```

/\*! This file is auto-generated \*/ ’ title=“Embed Code” class=“input-embed input-embed-14341” readonly/>

```
					<button class="copy-embed copy-embed-14341" title="Copy Embed Code" aria-label="Copy Embed Code"></button>


```

As you know, DKIM catches alterations made to emails during their time in transit. _It performs authentication checks by attaching a digital signature to the header of each email that goes from your domain_. Upon reception, the receiving server verifies the \*\*sender’s legitimacy using the [public key](https://www.techtarget.com/searchsecurity/definition/public-key) published in the sending domain’s DNS .

However, when someone **forwards your emails**, or you send them using [mailing lists](https://dmarcreport.com/blog/does-forwarding-mailers-affect-dmarc-alignment-and-how-to-mitigate/), DKIM breaks. So, let’s see why it happens and if there is a way for you to mitigate it.

## How does DKIM work?

There are two major steps in DKIM’s process-

## Signing

When someone sends an email from your DKIM-compliant domain , your server generates a DKIM signature using the [private key](https://www.techopedia.com/definition/16135/private-key). The signature is attached to the header of the outgoing email\*\*.

![What is dmarc](https://media.mailhop.org/dmarcreport/images/2024/07/what-is-dmarc-5.jpg) 

## Verification

The receiving \*\*mail server retrieves the public key from the sender’s [DNS record](https://www.ibm.com/topics/dns-records) and uses it to verify the DKIM signature. _If the signature matches, DKIM passes, and the recipient’s mailbox considers the message as legitimate_.

## DKIM and forwarded emails

When an email is forwarded, it typically passes through an **intermediary server**. Here are the primary ways forwarding can impact DKIM:

## Header modifications

Forwarding services may \*\*add or modify email headers. Since DKIM signs the [email headers](https://www.hostinger.in/tutorials/email-headers/), any changes can invalidate the DKIM signature.

## Body modifications

Some \*\*forwarding services modify the body of the email (e.g., adding footers). If the body hash changes, the DKIM signature will no longer match.

## Re-signing

Some forwarders may re-sign the email with their own [DKIM signature](https://documentation.mapp.com/1.0/en/dkim-signature-12570662.html), which can help, but the original signature will still appear broken unless the \*\*intermediary’s changes are carefully managed.

## DKIM and mailing lists

The following challenges occur when you send emails to members of a mailing list:

## Header and body changes

Mailing lists tend to **add list-specific headers** (for example, list ID) and footers (for example, an unsubscribe button). T\_his modifies both headers and body content, creating problems in the validation process\_.

## Signature address changes

Some mailing lists make changes to the \*\*sender’s address and replace it with the list’s address. This can cause issues with [DKIM](https://dmarcreport.com/what-is-dkim/) if the new address doesn’t align with the domain used for the DKIM signature.

## Re-signing by the mailing list

Some mailing lists may re-sign the email with their own DKIM signature. This helps ensure the \*\*email’s integrity from the mailing list to the recipient but does not preserve the original sender’s DKIM signature.

![How to create dmarc record](https://media.mailhop.org/dmarcreport/images/2024/07/how-to-create-dmarc-record-4968.jpg) 

## Why DKIM breaks

As explained above, the headers and body content of \*\*emails undergo alterations when they are forwarded or passed through mailing lists. DKIM’s primary purpose is to verify whether email content was altered in transit. If it detects any differences between the email sent originally and the version received by the recipient, the [DKIM check fails](https://dmarcreport.com/blog/10-reasons-why-dkim-fails/).

_This is exactly what happens when emails are forwarded or passed through mailing lists, causing DKIM to break_. In short, modifications can invalidate the DKIM signature, \*\*leading to verification failures.

## Mitigation strategies

You can prevent DKIM from breaking by employing these three strategies-

## ARC (Authenticated Received Chain)

[Authenticated Received Chain](https://proton.me/blog/what-is-authenticated-received-chain-arc) allows each intermediary to add their own \*\*authentication results and DKIM signatures, preserving the chain of trust.

## Re-signing by Intermediaries

Forwarding services and mailing lists can re-sign emails with their own [DKIM keys](https://dmarcreport.com/blog/dkim-key-rotation-best-practices-for-large-organizations-should-know/), ensuring the **email remains authenticated**, though this does not preserve the original signature.

## Use of DMARC

[DMARC](https://dmarcreport.com/) can specify policies for handling DKIM and [SPF failures](https://dmarcreport.com/blog/what-causes-spf-record-failure-and-how-to-troubleshoot-common-issues/), allowing \*\*domain owners to specify actions like quarantine or rejecting unauthenticated emails, reducing the impact of broken DKIM signatures.

A useful element of DMARC is its reporting feature, which enables you to \*\*monitor your email activities and detect [illegitimate emails](https://www.linkedin.com/pulse/illegitimate-emails-protect-yourself-indigo-it-limited). Contact us to outsource your [DMARC reporting and monitoring](https://dmarcreport.com/blog/dmarc-report-monitoring-made-simple-for-growing-businesses/) headache.

## Topics

[ dkim ](/tags/dkim/)[ DMARC ](/tags/dmarc/)[ dns record ](/tags/dns-record/) 

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

[ Brad Slavin ](/authors/brad-slavin/) 

General Manager

Founder and General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base.

[LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) 

## Take control of your DMARC reports

Turn raw XML into actionable dashboards. Start free - no credit card required.

[Start Free Trial](https://app.dmarcreport.com/) [Check Your DMARC Record](/tools/dmarc-checker/) 

## Related Articles

[  Intermediate 5m  How to Set Up DKIM in Amazon SES?  Jun 10, 2024 ](/blog/how-to-set-up-dkim-in-amazon-ses/)[  Intermediate 3m  Setting DKIM keys for Salesforce  Aug 9, 2024 ](/blog/setting-dkim-keys-for-salesforce/)[  Intermediate 8m  Decoding I-Tag DKIM Vulnerability and Its Impact on Email Deliverability and Security  Jun 6, 2024 ](/blog/decoding-i-tag-dkim-vulnerability-and-its-impact-on-email-security/)[  Intermediate 6m  How to Generate a DMARC Record for Subdomains: sp= Tag Guide  Apr 13, 2026 ](/blog/generate-dmarc-record-subdomains-sp-tag-guide/)

```json
{"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"470","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"Does DKIM break for forwarded emails and mailing lists?","description":"Does DKIM break for forwarded emails and mailing lists? from DMARC Report explains practical steps for email authentication, domain protection.","url":"https://dmarcreport.com/blog/does-dkim-break-for-forwarded-emails-and-mailing-lists/","datePublished":"2024-07-11T09:16:18.000Z","dateModified":"2026-04-16T15:53:43.000Z","dateCreated":"2024-07-11T09:16:18.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"470","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/does-dkim-break-for-forwarded-emails-and-mailing-lists/"},"articleSection":"intermediate","keywords":"dkim, DMARC, dns record","wordCount":1022,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-record-6071.jpg","caption":"Does DKIM break for forwarded emails and mailing lists?","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://dmarcreport.com/intermediate/"},{"@type":"ListItem","position":4,"name":"Does DKIM break for forwarded emails and mailing lists?","item":"https://dmarcreport.com/blog/does-dkim-break-for-forwarded-emails-and-mailing-lists/"}]}
```