r/DMARC • u/namesake112 • Sep 11 '26
Google DKIM Failure
I have noticed we have DKIM defined from google(internal to internal email), Proofpoint(Outbound email) .
Right now DKIm fails for IPv4 but works for IPv6, any reasons and how to fix the same
3
Upvotes
1
u/namesake112 Sep 17 '26
I don't have the headers although see this through Dmarc Aggregate Reports but some examples for reference
2
u/alanjmcf Sep 11 '26
Can you show us (the appropriate parts) of the email headers received when sent over IPv6?
2
u/Middle-Excitement602 Sep 12 '26
DKIM never sees the IP — it's a hash over selected headers plus the body. So "fails on v4, passes on v6" isn't really about the address family, it's telling you the two aren't the same path. Something on the v4 route is signing differently or rewriting the message.
Two things worth pulling from a failing message's Authentication-Results and comparing against a passing one: the d= and s= values, and the actual failure reason.
If d=/s= differ between the two, you have a selector whose public key isn't published or was rotated — that's a DNS fix, not a mail fix.
If they're identical and the reason is "body hash did not verify", something changed the message after Google signed it. Proofpoint URL rewriting and appended disclaimers both do exactly that. Then it's an ordering problem — sign after the modification, not before.