What this checks
Most header analyzers only read the Authentication-Results header your mailbox added. This tool repeats the verification itself: it canonicalizes the headers and body exactly as RFC 6376 describes, recomputes the body hash (bh=), fetches the public key from DNS and verifies the RSA or Ed25519 signature (b=). It then compares the signing domain with the From domain, which is what DMARC needs.
Reading the result
- Body hash mismatch: the body changed after signing (a footer added by a list or gateway, or line endings altered when copying).
- Signature fails with a good body hash: a signed header changed, or the key in DNS is not the one the sender signs with.
- permerror: the key is missing, revoked or unusable, or the signature uses SHA-1, which RFC 8301 retired.
- Not aligned: the signature is valid but for another domain (often the sending provider's), so it does not help DMARC.
DKIM signature validator: questions
Why does DKIM fail with body hash did not verify?+
Because the body changed after the message was signed, so it no longer matches the bh= value in the signature. Common causes are a footer added by a mailing list or security gateway, rewritten links, re-encoded text or line endings, and copying the message from a client that alters it. Trimming attachments before pasting has the same effect.
Why does a DKIM signature fail when the body hash matches?+
Because a signed header changed or the key in DNS is not the one that signed. Lists and gateways often edit the Subject or another signed header, and a selector whose key was rotated or replaced after sending no longer verifies older mail. The validator reports the body hash and the signature separately, so you can tell the two failures apart.
How do I get the raw source of an email?+
Open the message in your mail client's source view. In Gmail, use the three-dot menu, Show original, then Copy to clipboard; in Apple Mail, View, Message, Raw Source; in Outlook on the web, More actions, View, View message source. Paste everything, every header and the full body exactly as received, or the body hash cannot be checked.
Does a DKIM pass mean DMARC passes?+
Only if the signing domain aligns with the From domain. DMARC counts a DKIM pass when d= is the From domain or, under the default relaxed alignment, shares its organizational domain: d=mail.example.com aligns with From example.com, d=sendgrid.net does not. The validator shows relaxed and strict alignment for every signature it checks.
Is a DKIM signature with SHA-1 still valid?+
No. RFC 8301 forbids rsa-sha1 for both signing and verifying, so the validator reports such a signature as permerror. Valid signatures use rsa-sha256, or ed25519-sha256 from RFC 8463, and the validator verifies both, together with the body hash, the expiry time in x= and the key published in DNS.
Can I verify a message larger than 256 KB?+
Not in the web tool, which accepts up to 256 KB of pasted text. Trimming attachments to fit makes the body hash fail, because it covers the whole body, though the header signature is still checked. The EmailSecOps REST API and the verify_dkim_signature tool on the public MCP server accept messages up to 1 MB.