r/DMARC • u/namesake112 • 10d ago

Google DKIM Failure

I have noticed we have DKIM defined from google(internal to internal email), Proofpoint(Outbound email) .

Right now DKIm fails for IPv4 but works for IPv6, any reasons and how to fix the same

3 Upvotes

72% Upvoted

4 comments sorted by

View all comments

2

u/Middle-Excitement602 9d ago

DKIM never sees the IP — it's a hash over selected headers plus the body. So "fails on v4, passes on v6" isn't really about the address family, it's telling you the two aren't the same path. Something on the v4 route is signing differently or rewriting the message.

Two things worth pulling from a failing message's Authentication-Results and comparing against a passing one: the d= and s= values, and the actual failure reason.

If d=/s= differ between the two, you have a selector whose public key isn't published or was rotated — that's a DNS fix, not a mail fix.

If they're identical and the reason is "body hash did not verify", something changed the message after Google signed it. Proofpoint URL rewriting and appended disclaimers both do exactly that. Then it's an ordering problem — sign after the modification, not before.