Summary
Mimecast, a popular email security and archiving service, can sometimes interfere with DKIM (DomainKeys Identified Mail) body hash verification, leading to authentication failures. This issue often arises because email security gateways like Mimecast modify email content for various reasons, such as scanning for malware, adding disclaimers, or rewriting URLs for security. Any alteration to the email body after the DKIM signature is applied will cause the body hash to no longer match the calculated hash, resulting in a DKIM failure. Understanding these underlying modifications is crucial for diagnosing and resolving such deliverability challenges.
Key findings
- Content modification: Mimecast's processes, such as URL rewriting or adding footers, can inadvertently alter the email body. These changes occur after the sending server has applied the DKIM signature, leading to a body hash mismatch. Such unintentional modifications are a common cause of DKIM body hash failures.
- Internal verification: Failures often occur at the relay.mimecast.com hop, indicating that Mimecast's internal processing is the point of failure for the DKIM signature, not a subsequent receiver.
- Impact on deliverability: When DKIM fails, it signals to receiving mail servers that the email's integrity has been compromised or that it might be a spoofed message, potentially leading to rejection or placement in the spam folder. This is a common challenge for email authentication at various ISPs.
- Historical precedence: There have been past instances where Mimecast's email repacking processes were known to break DKIM body hashes.
Key considerations
- Email content integrity: Ensure your sending infrastructure applies DKIM signatures before any potential content modification by intermediate gateways. This is crucial for maintaining email authentication validity.
- Canonicalization: Using 'relaxed' canonicalization for both header and body can offer more leniency to minor modifications by mail transfer agents or security solutions. However, even 'relaxed' mode might not tolerate significant content changes.
- Sender agreements: For critical emails, coordinate with recipients using Mimecast to ensure their Mimecast settings whitelist your sending domain or exclude it from content modification policies that impact DKIM.
- Monitoring DMARC reports: Regularly review DMARC aggregate reports to identify trends in DKIM failures attributed to Mimecast. This data can help pinpoint specific issues and domains experiencing problems.
What email marketers say
Email marketers and deliverability professionals often face challenges with security gateways like Mimecast causing DKIM authentication issues. Many report seeing DKIM body hash failures specifically with Mimecast recipients, even when their emails pass DKIM checks with other providers. The consensus points to Mimecast's inherent mail processing features as the root cause, leading to modifications that invalidate the original DKIM signature.
Key opinions
- Suspected content garbling: Many marketers question if Mimecast invisibly alters email content enough to cause DKIM body hash failures, particularly when emails are otherwise perfectly signed.
- Proxy and content rewriting: A common theory is that Mimecast replaces URLs with a proxy or adds footers to emails, which could break DKIM signatures if done before validation. This type of modification impacts DKIM body hash mismatch failures.
- Specific point of failure: Observation of authentication results shows DKIM failing at relay.mimecast.com, suggesting the issue originates within Mimecast's processing.
- Impact of security products: Some note that similar issues arise with other security products, such as Barracuda refusing to implement ARC, leading to broader authentication problems.
Key considerations
- Diagnostic steps: Marketers are advised to obtain full message samples, not just headers, to identify specific content modifications that might be causing the DKIM failure. This helps in diagnosing DKIM failures across various ISPs.
- Communication with recipients: It is often necessary to work with recipients using Mimecast to adjust their settings, ensuring that Mimecast does not modify emails in a way that breaks DKIM for trusted senders.
- Library compatibility: Consider whether DKIM signing libraries used by senders are fully compatible and robust, as some tools have had recent issues with DKIM verification, requiring updates or switches. This relates to Mimecast's DKIM issues.
- Preventing unintended modifications: Sending platforms should be configured to avoid adding footers or making other changes after DKIM signing that could lead to hash mismatches.
Marketer view
Marketer from Email Geeks questions whether Mimecast frequently garbles email content, causing DKIM body hash failures, especially when emails are perfectly valid otherwise. They ask if there are specific coding or decoding practices to be aware of, like avoiding 7-bit encoding.
Marketer view
Marketer from Email Geeks asks if the DKIM failures are happening at the first hop or are being observed in DMARC reports. This clarifies the stage at which the DKIM signature is being broken.
What the experts say
Experts in email deliverability acknowledge that security gateways are a frequent source of DKIM validation issues. Their primary function to protect recipients by altering or scanning content inherently conflicts with DKIM's integrity checks. When a service like Mimecast modifies an email after the sender signs it, the body hash will inevitably fail. Solutions often involve configuration adjustments on either the sending or receiving end, or adopting more flexible authentication standards like ARC (Authenticated Received Chain).
Key opinions
- Post-signing modification: Many experts agree that security gateways modify emails post-signing for various reasons, such as adding disclaimers, removing malicious content, or URL rewriting, which causes the DKIM body hash to break. These unintentional alterations commonly trigger DKIM failures.
- Canonicalization impact: Even with 'relaxed' canonicalization, some modifications are too extensive to be ignored, leading to validation failures. Strict canonicalization is even more susceptible.
- Interception point: The issue typically occurs at the point of interception by the security gateway, confirming that their processing is the direct cause of the broken signature.
- Authentication standard conflicts: The core conflict lies between the need for email integrity (DKIM) and the need for security processing (gateways), highlighting the importance of solutions like ARC for preserving authentication chains. This often results in DKIM failing at some ISPs but not others.
Key considerations
- ARC implementation: Experts recommend advocating for the implementation of ARC by email security providers, as it allows mail servers to validate the original authentication status of an email even after it has been modified by intermediate relays.
- Sender policy enforcement: Senders should strive to have minimal content modification between their signing MTA and the receiving mail server. This means avoiding unnecessary additions like footers or tracking pixels after the DKIM signature is applied.
- Whitelist configuration: Advise recipients using Mimecast to configure internal policies that prevent content modification for trusted senders, or to whitelist specific sending domains to bypass certain scans.
- Regular testing: Periodically test email authentication with various recipients, especially those using enterprise-grade security solutions like Mimecast, to proactively identify and address potential DKIM body hash failures. This helps diagnose and reduce DKIM temporary error rates.
Expert view
Expert from SpamResource highlights that any email security gateway that modifies the message body, even subtly, will break a DKIM signature. This is a fundamental challenge when trying to ensure email integrity through DKIM in a complex email ecosystem.
Expert view
Expert from DuoCircle explains that unintentional DKIM failures occur when legitimate message modifications, such as those made by antivirus scanners or email archiving systems, alter the email after it has been signed. This is a common issue with security providers like Mimecast.
What the documentation says
Official documentation and email authentication standards clarify that DKIM signatures are highly sensitive to any post-signing modifications. RFC 6376, which defines DKIM, specifies how signatures are generated based on the exact content of headers and body. Any intermediary, including email security gateways, that alters the message after signing will cause the cryptographic hash to fail verification. This highlights the inherent tension between robust authentication and necessary security filtering.
Key findings
- DKIM sensitivity: DKIM is designed to detect any alteration to the signed parts of an email. If the body is included in the signature (which it typically is), even minor changes invalidate the signature.
- RFC compliance: RFC 6376 dictates how DKIM body hashes are calculated. Any non-compliant modification by an intermediary will result in a body hash mismatch. This helps understand why DKIM may fail for specific providers.
- Canonicalization modes: While 'relaxed' canonicalization tolerates minor whitespace and header field casing changes, it does not permit content alterations like added footers, rewritten URLs, or re-encoding.
- ARC as a solution: The Authenticated Received Chain (ARC) standard was developed to allow intermediate mail servers and security gateways to re-sign emails after modification while preserving the original authentication results, mitigating issues with forwarded or modified mail.
Key considerations
- Security vs. integrity: Organizations using security gateways must balance the benefits of content scanning and modification against the need for valid email authentication. This often requires careful configuration.
- Gateway configuration: Documentation for security solutions like Mimecast often provides options to disable certain content modification features or to whitelist specific senders to prevent DKIM breakage.
- Sender responsibility: Senders are responsible for ensuring their DKIM signatures are applied correctly and that their outbound email path minimizes modifications that could impact authentication. For more details on common causes for DKIM body hash failures, see our guide.
- Reporting: DMARC reporting is crucial for identifying authentication failures caused by security gateways. The aggregate reports provide detailed insights into where and why DKIM is failing.
Technical article
Documentation from RFC 6376, the standard for DKIM, specifies that the body hash is calculated over the entire body of the message, with a canonicalization algorithm applied. Any change to the body content after signing, no matter how small, will cause the hash to mismatch.
Technical article
Documentation from a Mimecast support article states that certain features, such as URL Protection or content scanning, involve modifying the message body to enhance security. While this improves protection, it can interfere with email authentication mechanisms like DKIM if not properly configured.
Related resources
6 resources
Related pages
How to fix DKIM body hash did not verify errors on Outlook.com and prevent emails from going to spam?
Why is my DKIM body hash failing and how do I fix it?
Why are DKIM validations failing intermittently with Office365?
Why does DKIM authentication sometimes fail with certain ISPs or receivers like Barracuda and Proofpoint?
Why is DKIM failing at some ISPs but not others, and how can I fix it?
How do I fix DKIM failing body hash verification?
How to fix DKIM body hash mismatch failures
Diagnosing and reducing DKIM temporary error rates with Microsoft
Decoding DKIM temperror: what it is and how to fix it
A simple guide to DMARC, SPF, and DKIM
