Outbound emails do not pass DKIM verification when primary DNS zone for domain is hosted externally

Symptoms

• Outbound (outgoing) emails do not pass DKIM verification. The following can be found in source message on recipient side:

  ARC-Authentication-Results: i=1;
  dkim=fail

• Third party DKIM test services like http://dkimvalidator.com or https://www.mail-tester.com/ show the following in "Validating Signature" section:

  result = fail
  Details: bad RSA signature

  ---

  Validating Signature
  result = fail
  Details: OpenSSL error: data too small for key size

  ---

  Your DKIM signature is not valid

• The affected domain is using an external DNS zone (and external nameservers) as primary, instead of the DNS zone that resides on the side of your Plesk server

Cause

The TXT record for default._domainkey.example.com, which is set in Plesk > Domains > Mail > Mail Settings example.com > DNS Settings does not match with the current DNS TXT record that resides on the side of the primary DNS zone of the domain (or is missing entirely from the primary DNS zone of the domain):

# dig +short TXT default._domainkey.example.com @203.0.113.2
"v=DKIM1\; p=MIGfMA0GCSqGSIb3DQEBAQU111...
# dig +short TXT default._domainkey.example.com @8.8.8.8
"v=DKIM1\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4...

Resolution