DKIM fail sending to Office 365 and Outlook.com

lukekenny

Member
Jan 24, 2018
18
3
3
Melbourne, Australia
cPanel Access Level
Root Administrator
This is a bit of a weird one. WHM DKIM & SPF is set up correctly, and emails sent through the cPanel accounts to test services like dkimvalidator.com/ show DKIM passed. Emails sent to Gmail show DKIM passed.

However, emails sent to Office365 Exchange accounts and Outlook.com accounts show DKIM fail.

A sanitised example from an Office365 recipient:

Authentication-Results: spf=pass (sender IP is 1.1.1.1)
smtp.mailfrom=senderdomain.com.au; receivedomain.com.au; dkim=fail
(signature did not verify)

header.d=senderdomain.com.au;receivedomain.com.au; dmarc=pass action=none
header.from=senderdomain.com.au;compauth=pass reason=100

Where as the exact same test message sent to a Gmail account:

ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass [email protected] header.s=default header.b=uDV+6ipX;
spf=pass (google.com: domain of [email protected] designates 1.1.1.1 as permitted sender) [email protected];
dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=senderdomain.com.au

DMARC was enabled manually for this domain, trying to solve the problem. It doesn't make a difference if it's on or off.

dkimvalidator.com shows DKIM passes.

Does anyone have any idea what additional steps / configuration is required to get cPanel emails passing Microsoft's checks?
 
Last edited by a moderator:

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,909
2,228
463
Hello @lukekenny,

Can you open a support ticket so we can take a closer look at the affected system to determine why DKIM verification fails when sending email to Office365/Outlook.com email servers? You can post the ticket number here and we'll link this thread to it.

Thank you.
 

QAZwsxED

Member
Oct 4, 2020
9
0
1
Australia
cPanel Access Level
Website Owner
I recently solved a similar issue.
Solution: manually add a Message-Id (note not a Message-ID) header then connect and send an email.
cPanel WHM adds a Message-ID header and re-arranges the 'h' record in the DKIM signature which invalidates it, causing a DKIM:fail in the recipients mailbox.