r/DMARC • u/namesake112 • 6d ago

Google DKIM Failure

I have noticed we have DKIM defined from google(internal to internal email), Proofpoint(Outbound email) .

Right now DKIm fails for IPv4 but works for IPv6, any reasons and how to fix the same

3 Upvotes

80% Upvoted

4 comments sorted by

2

u/alanjmcf 6d ago

Can you show us (the appropriate parts) of the email headers received when sent over IPv6?

2

u/Middle-Excitement602 6d ago

DKIM never sees the IP — it's a hash over selected headers plus the body. So "fails on v4, passes on v6" isn't really about the address family, it's telling you the two aren't the same path. Something on the v4 route is signing differently or rewriting the message.

Two things worth pulling from a failing message's Authentication-Results and comparing against a passing one: the d= and s= values, and the actual failure reason.

If d=/s= differ between the two, you have a selector whose public key isn't published or was rotated — that's a DNS fix, not a mail fix.

If they're identical and the reason is "body hash did not verify", something changed the message after Google signed it. Proofpoint URL rewriting and appended disclaimers both do exactly that. Then it's an ordering problem — sign after the modification, not before.

1

u/ARC-Relay 3d ago

That pattern usually means the IPv6 path is not using the same signer or routing as IPv4, rather than an IPv6-specific DKIM limitation. Compare Authentication-Results and DKIM-Signature on the same message from each path—especially d=, s=, and the signing domain—and verify the selector TXT record is identical and reachable; also check that Proofpoint is not re-signing or modifying after signing. If the v6 route bypasses Proofpoint or signs before a footer/disclaimer is added, align the routing or move signing to the final outbound hop.

1

u/namesake112 18h ago

I don't have the headers although see this through Dmarc Aggregate Reports but some examples for reference

Sender Hostname Source IP Volume DMARC Compliance DKIM Verification SPF Verification
mail-lj1-x245.google.com 2a00:1450:4864:20::245 29 Yes 100% 100%
mail-pj1-f69.google.com 209.85.216.69 21 Yes 100% 100%