Articles in this section

See more

After migration DKIM verification fails: dkim=fail (body hash did not verify)

Avatar
Taras Ermoshin
Updated
Follow
Plesk for Linux kb: bug ext: migrator ABT: Group B

Applicable to:

  • Plesk for Linux

Symptoms

  • After migration DKIM verification fails to send emails to Google, Hotmail or other mail services, as a result, some emails are rejected or classified as SPAM.

  • At Domains > example.com > DNS Settings: DKIM TXT record default._domainkey.example.com. looks like the following example :

    PLESK_INFO: v=DKIM1; p=DKIM1; p=OlDKey..;

  • New domains created contains a valid DKIM TXT record:

    PLESK_INFO: v=DKIM1; p=NeWkEy..;

Cause

This is caused by Plesk bug #PPPM-6529 that will be fixed in upcoming Plesk updates.

Resolution

There are 2 workarounds:

Click on a section to expand

Update the DKIM TXT record on the target's DNS zone for example.com to keep source DKIM TXT record

  1. Log in to Plesk

  2. Go to Domains > example.com > DNS Settings

  3. Click on DKIM TXT record: default._domainkey.example.com.

  4. Delete p=DKIM1; from TXT record and save changes.

As a result, record in Domains > example.com > DNS Settings will keep source DKIM key and it should look as follows:

CONFIG_TEXT: v=DKIM1; p=OlDKey..;

Re-create the DKIM TXT record from example.com, to keep target server DKIM TXT record

  1. Log in to Plesk

  2. Go to Domains > example.com > Mail Settings

  3. Disable Use DKIM spam protection system to sign outgoing email messages and save.

  4. Enable again Use DKIM spam protection system to sign outgoing email messages and save.

As a result, record in Domains > example.com > DNS Settings will have a new DKIM key and it should look as follows:

CONFIG_TEXT: v=DKIM1; p=NeWkEy..;

Comments

5 comments

Sort by Date Votes
  • Avatar
    Benjamin Brummer (Edited )

    The same for me both solutions did not work. Body Hash is always invalid. Switched DKIM of for now.

    Reinstalled postfix, enabled disabled DKIM for domains and for the whole server, but no way to fix the issue.

    Ubuntu 20.04 + Plesk 18.0.43 Update 1

    0
    Comment actions Permalink
  • Avatar
    Raivo Kaldma (Edited )

    after migrating from plesk 17 to 18 some mailservers fails to verify DKIM - DKIM-Result: fail (wrong body hash:
    this happen with mail.com and some others mailservers

    Gmail is ok.

    I tried both 2 workarounds, no help.

    And DKIM signature contains h=Recived: tag
    But i read that signature must not contain Recived (http://dkim.org/specs/rfc4871-dkimbase.html 5.5

    The following header fields SHOULD NOT be included in the signature:

    • Return-Path
    • Received
    • Comments, Keywords
    • Bcc, Resent-Bcc
    • DKIM-Signature



    0
    Comment actions Permalink
  • Avatar
    Fatih Orhan (Edited )

    The same goes here! DKIM body hash is not correct even if DKIM public key from Plesk is used and verified.

    The expected body hash is listed below

    https://docs.plesk.com/en-US/obsidian/customer-guide/mail-settings/enabling-dkim-email-signing.74718/

     

    0
    Comment actions Permalink
  • Avatar
    Ivan Postnikov (Edited )

    Hello @Marcos, please, try this instruction to troubleshoot the issue.

    0
    Comment actions Permalink
  • Avatar
    Marcos Martinez

    I only have this issue when the recipient is hotmail, for yahoo, gmail, and other DKIM is working fine. I've tried the two workarounds but it did not work.

    Any idea why I only have this issue with hotmail accounts?

    0
    Comment actions Permalink

Please sign in to leave a comment.

Have more questions? Submit a request

Related articles