Does DKIM break for forwarded emails and mailing lists?

DMARC Report
Does DKIM break for forwarded emails and mailing lists?

As you know, DKIM catches alterations made to emails during their time in transit. It performs authentication checks by attaching a digital signature to the header of each email that goes from your domain. Upon reception, the receiving server verifies the sender’s legitimacy using the public key published in the sending domain’s DNS

However, when someone forwards your emails, or you send them using mailing lists, DKIM breaks. So, let’s see why it happens and if there is a way for you to mitigate it.

How does DKIM work?

There are two major steps in DKIM’s process-


When someone sends an email from your DKIM-compliant domain, your server generates a DKIM signature using the private key. The signature is attached to the header of the outgoing email.

public and private key

Image sourced from


The receiving mail server retrieves the public key from the sender’s DNS record and uses it to verify the DKIM signature. If the signature matches, DKIM passes, and the recipient’s mailbox considers the message as legitimate.

DKIM and forwarded emails

When an email is forwarded, it typically passes through an intermediary server. Here are the primary ways forwarding can impact DKIM:

Header modifications

Forwarding services may add or modify email headers. Since DKIM signs the email headers, any changes can invalidate the DKIM signature.

Body modifications

Some forwarding services modify the body of the email (e.g., adding footers). If the body hash changes, the DKIM signature will no longer match.

Forwarding emails


Some forwarders may re-sign the email with their own DKIM signature, which can help, but the original signature will still appear broken unless the intermediary’s changes are carefully managed.

DKIM and mailing lists

The following challenges occur when you send emails to members of a mailing list:

Header and body changes

Mailing lists tend to add list-specific headers (for example, list ID) and footers (for example, an unsubscribe button). This modifies both headers and body content, creating problems in the validation process

Signature address changes

Some mailing lists make changes to the sender’s address and replace it with the list’s address. This can cause issues with DKIM if the new address doesn’t align with the domain used for the DKIM signature.

mailing list

Re-signing by the mailing list

Some mailing lists may re-sign the email with their own DKIM signature. This helps ensure the email’s integrity from the mailing list to the recipient but does not preserve the original sender’s DKIM signature.

Why DKIM breaks

As explained above, the headers and body content of emails undergo alterations when they are forwarded or passed through mailing lists. DKIM’s primary purpose is to verify whether email content was altered in transit. If it detects any differences between the email sent originally and the version received by the recipient, the DKIM check fails

This is exactly what happens when emails are forwarded or passed through mailing lists, causing DKIM to break. In short, modifications can invalidate the DKIM signature, leading to verification failures.

Mitigation strategies

You can prevent DKIM from breaking by employing these three strategies-

ARC (Authenticated Received Chain)

Authenticated Received Chain allows each intermediary to add their own authentication results and DKIM signatures, preserving the chain of trust.

Re-signing by Intermediaries

Forwarding services and mailing lists can re-sign emails with their own DKIM keys, ensuring the email remains authenticated, though this does not preserve the original signature.

Use of DMARC

DMARC can specify policies for handling DKIM and SPF failures, allowing domain owners to specify actions like quarantine or rejecting unauthenticated emails, reducing the impact of broken DKIM signatures.

A useful element of DMARC is its reporting feature, which enables you to monitor your email activities and detect illegitimate emails. Contact us to outsource your DMARC reporting and monitoring headache. 

Similar Posts