Intermittent DKIM authentication failing

Question

We are recently deploying DMARC and seeking additional details about an issue. DMARC is configured in the most basic way:

v=DMARC1; p=none; rua=mailto:dmarcreports@example.com

Our primary server signs outgoing messages with DKIM keys but the first report we received this morning shows approximately 25% of those messages failing both authentication and alignment.

When I inspect headers on messages we are sending everything appears to be in order. I can't understand why only some of the messages would fail if DKIM is configured properly. Could this be related to forwarding? How can i find out? I looked into adding forensic reporting but apparently there are almost no providers that support it.

What would cause this and how can I investigate which messages are failing authentication?

Answer 1

What would cause this [25% of those messages failing both authentication and alignment]...

Failing authentication is obvious. DKIM signatures in emails don't validate.

Failing DMARC alignments means that the DKIM signature is from a different domain that the one in the "From" header. Check the d= tag in the DKIM-Signature header. It must match the "From" address for DMARC to pass.

...Could this be related to forwarding?

Yes.

...and how can I investigate which messages are failing authentication?

It is on your DMARC reports. More specifically, the reports contain who is sending with a "From" using your domain, who is using which DKIM selector, SPF domains checked, and which one is passing and which is not.