How to fix DKIM Permerror?
by
Last Updated: Reading Time: 4 min
DKIM Permerror or DKIM permanent error can be a result of a failed DKIM verification due to missing header fields. Note that once the DKIM Permerror result is returned, unless the sender undergoes troubleshooting, future verification attempts on the same message will also fail. DKIM issues can lead to failures in email delivery if your DMARC policy is at p=reject.
Key Takeaways
- DKIM Permerror often results from missing mandatory header fields in the DKIM signing header.
- Erroneous DKIM strings in DNS settings can cause DKIM Permerror during the setup process.
- Spam filters can override DKIM authentication, leading to Permerror if not properly configured.
- Using a DKIM record generator can help prevent human error and ensure accurate DKIM setup.
- Regularly checking your DKIM record with a lookup tool can help maintain proper email authentication.
What is DKIM Permerror?
DKIM Permerror is a common error that can occur when you’re setting up DKIM (Domain Keys Identified Mail) in your email program. It may look something like this:
DKIM is a security feature that allows you to digitally sign messages with a private key, and then verify the authenticity of those messages by using your public key. It’s often used with SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting, and Conformance) to make sure that only mail from authorized senders is delivered to recipients’ inboxes.
The reason you’re receiving this error is that some steps are missing from your setup process. Most often, this happens because you haven’t properly configured your DNS settings or have missed an important step in the configuration process. You may have also entered an erroneous DKIM string to contribute to this result.
If you receive this error while setting up DKIM, don’t worry! We’ve got all of our best tips and tricks right here to help you get past it fast.
Simplify DKIM Permerror with PowerDMARC!
Possible Reasons for DKIM Permerror
- DKIM Signature Missing Header Fields
A DKIM signature header is a way to verify the authenticity of an email message. It’s a security measure that ensures emails are coming from the correct source. A DKIM signature header is a digital signature created by the sender and added to a message. The receiver can then compare this digital signature with the one they generated themselves to ensure that the email was sent by the correct person or organization.
Mandatory fields:
v= The version of DKIM in use (value=1)
d= the sender’s domain name
a= This field denotes the key algorithm used to generate the signature with values: rsa-sha256 (for enhanced protection) or rsa-sha1 (for unsupported servers)
s= DKIM selector (an alphanumeric value that may range between 1028 and 2048 bits) to locate the public key in the sender’s DNS.
h= the list of headers that are used in the signing algorithm to compute a hash data of message headers that would be defined in the b=tag.
b= the computed hash data of the message headers that are encoded in a special MIME content transfer encoding called Base64.
bh= the computed hash value of the message body. This field contains an arbitrary string of alphanumeric variables that are generated using the signing algorithm.
If any of these mandatory fields are missing in the DKIM signing header, it will lead to DKIM Permerror.
-
Erroneous DKIM string
Making sure that your DKIM DNS record is error-free is important in ensuring that you don’t end up with DKIM permanent error or DKIM Permerror result. If your DNS settings are controlled by a remote nameserver, you must get in touch with your DNS provider to access the DNS on the remote server and relay changes to configure the correct syntax.
-
Using Spam Appliances
Your spam filters can override DKIM authentication settings on the receiver’s side. This is because spam filters are usually the last line of defense. When your receiver checks the server for the signature it is essentially checking the last server through which the message was relayed i.e. your spam appliance. The absence of DKIM keys there will lead to DKIM Permerror.
Troubleshooting DKIM Check: Permerror Result
- Create a DKIM record using a DKIM record generator tool – manual implementations are prone to human error. Using an online tool can help you get accurate results.
- Check your configured DKIM record using a DKIM lookup tool – To stay on top of DKIM Permerror, periodically check your record syntax to make sure it is valid and functional.
- If you are coming across this error when using Microsoft O365 or any other third party to send emails and also have your spam appliance in place, it may be a result of your spam filters overriding your Office 365 DKIM policy. Make sure DKIM is enabled on both your spam appliance (which is your last line of defense) as well your email vendor’s DNS to resolve DKIM Permerror.
Domain & Email Security Expert at PowerDMARC
Ahona is the Marketing Manager at PowerDMARC, with 5+ years of experience in writing about cybersecurity topics, specializing in domain and email security. Ahona holds a post-graduation degree in Journalism and Communications, solidifying her career in the security sector since 2019.
Latest posts by Ahona Rudra (see all)
- DMARC MSP Case Study: Mofco Secures Client Domains Against Spoofing with PowerDMARC - February 24, 2026
- NCSC Mail Check Changes & Their Impact on UK Public Sector Email Security - February 23, 2026
- PCI DSS 4.0.1 For Hotels: Email Authentication Strategies - February 17, 2026
