Why am I seeing Yahoo email errors with DKIM failing even though SPF and DMARC pass?
Published 1 May 2025
Updated 26 Jul 2026
12 min read
Summarize with
Updated on 26 Jul 2026: We updated this guide with Yahoo's current DKIM requirements and a safer message-level troubleshooting path.
Yahoo can show dkim=permerror (bad sig) while SPF and DMARC pass because DMARC needs one authenticated path that matches the visible From domain. If SPF passes for a matching domain, DMARC can pass even when DKIM fails on the same message.
That does not make the DKIM error harmless. It means the signature Yahoo evaluated did not verify. Treat it as a message-level problem until the full header and raw message prove the cause. A DNS lookup can show that the public key exists, but it cannot prove that the signed body and headers still match the message Yahoo received.
The direct answer: Yahoo is not contradicting itself. SPF can provide the passing DMARC path while DKIM fails. For a bulk sender, that DMARC pass does not remove Yahoo's separate requirement to authenticate with DKIM. A Yahoo 554 5.7.9 rejection is broader than one DKIM result, so preserve the full bounce text before assigning the cause.
- Fast check: Read Yahoo's Authentication-Results header on the affected message, not only a sender dashboard.
- Main clue: Identify the SPF domain that made DMARC pass, then diagnose DKIM as a separate result.
- Best first move: Save the raw Yahoo sample and bounce before changing DNS or the sending path.
Why this happens
DKIM is not a DNS-only test. The sending system signs selected headers and the body, then publishes a public key in DNS. Yahoo retrieves that key and checks whether the received message matches the signature. A mail transfer agent, tracking layer, footer injector, security appliance, or encoding step can change signed content after signing and make verification fail even when the key is present and correctly formatted.
A campaign can pass at one mailbox and fail at Yahoo when the copies took different routes, a gateway changed one copy, DNS returned different answers during a key rotation, or the samples came from different sends. For the same raw message, public key, and canonicalization inputs, DKIM verification should produce the same cryptographic result. Compare exact samples before treating the difference as receiver-specific.
What a DNS DKIM check proves
- Selector exists: The selector record exists at the expected host name.
- Key parses: The public key has valid syntax and a supported key type.
- DNS answers: The authoritative DNS path returns a record at test time.
What Yahoo verifies
- Signature math: The body hash and signed headers match the received message.
- Header set: The fields listed in h= remain in the expected form and order.
- Body state: Line endings, wrapping, MIME boundaries, and encoding survived the route.
Infographic showing a DKIM signature passing through message changes before Yahoo verifies it.
What Yahoo is actually telling you
The Yahoo result dkim=permerror (bad sig) indicates a permanent DKIM evaluation error for that signature. Other Authentication-Results implementations use dkim=fail when the signature does not verify. A temporary DNS problem is normally reported as temperror, so preserve the exact result and reason text.
Yahoo's 554 5.7.9 text is a policy rejection, not a DKIM diagnostic by itself. Authentication can contribute, and Yahoo also considers IP reputation, domain reputation, URL reputation, complaint behavior, sending patterns, and standards compliance. Use the complete SMTP response and raw header to separate an authentication defect from the other policy signals.
Simplified Yahoo-style authentication resulttext
Authentication-Results: yahoo.com; spf=pass smtp.mailfrom=bounce.example.com; dkim=permerror (bad sig) header.d=example.com header.s=s1; dmarc=pass header.from=example.com
In this example, DMARC passes because SPF authenticates bounce.example.com, which shares the organizational domain with the visible From domain under relaxed SPF alignment. With strict SPF alignment, the domains must match exactly. If SPF passes for an unrelated domain, it cannot provide the DMARC pass, and failed DKIM leaves no passing DMARC path.
|
|
|
|---|---|---|
SPF pass | Envelope sender authenticated | SPF domain match |
DKIM permerror | Signature had a permanent error | Reason and raw message |
DMARC pass | At least one matching path passed | SPF or DKIM path |
554 5.7.9 | Yahoo policy rejection | Full SMTP response |
Read the Yahoo result as separate authentication and policy signals.
Yahoo Mail screenshot concept showing a 554 5.7.9 rejection and authentication details.
Yahoo requirements when DKIM fails
A passing DMARC result does not settle Yahoo sender compliance. Yahoo's published requirements treat bulk senders at the authenticated-domain or From-domain level and do not publish a fixed volume threshold. A sender that Yahoo classifies as bulk must authenticate with both SPF and DKIM, publish DMARC at p=none or stronger, and make DMARC pass.
- Bulk authentication: SPF and DKIM are separate requirements, even when SPF already gives DMARC a passing path.
- Key length: Yahoo requires a DKIM key of at least 1024 bits and recommends 2048 bits when supported.
- Multiple signatures: Yahoo evaluates every DKIM signature. If several signatures match the From domain and one fails, Yahoo does not guarantee a DMARC pass.
- Enforcement scope: The requirements apply to consumer email domains hosted by Yahoo Mail, including AOL, but not Yahoo Japan.
If one valid matching DKIM signature passes and another fails, do not stop at the aggregate DMARC verdict. Map each d= and s= pair to the system that added it, then repair or remove the broken signature.
Causes to test first
The highest-probability causes are close to the signing path. Prove whether the message left the final signer in the same form Yahoo received. If the body hash differs, a correct public key cannot make that signature pass.
- Post-signing edits: A footer, tracking pixel, rewritten link, MIME boundary, or legal disclaimer was added after DKIM signing.
- Header changes: A signed header was rewritten, removed, reordered, or duplicated after signing.
- Encoding drift: Quoted-printable wrapping, character encoding, line endings, or whitespace changed beyond what canonicalization permits.
- Selector or key mismatch: The message used an old selector, the public key was replaced too early, or the DNS key does not match the private key.
- Signature timing: The optional expiration time passed, or a signer produced an invalid timestamp.
- DNS reliability: The lookup returned a missing, revoked, truncated, stale, or inconsistent key response.
- Multiple signers: An application and outbound gateway both signed, but one signature used a stale selector or covered content changed by the next hop.
- Policy pressure: Yahoo combined failed DKIM with reputation, content, complaint, or blocklist (blacklist) signals.
Why record checks can mislead you
A DNS record check confirms that a selector returns a parseable key. It does not verify Yahoo's copy of the signed message. Suped's DKIM checker can confirm the selector and public key state. Pair that result with the Yahoo header and raw message to diagnose the signature.
DKIM fields worth checking in the signed messagetext
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=s1; t=1750000000; x=1750604800; h=from:to:subject:date:mime-version; bh=BASE64_BODY_HASH; b=BASE64_SIGNATURE;
A practical troubleshooting sequence
Do the checks in order. The goal is to identify the path that made DMARC pass, then isolate the broken DKIM signature without weakening the domain's published DMARC policy.
- Capture evidence: Save the full Yahoo bounce and raw message, including Authentication-Results, every DKIM-Signature, Received, and Return-Path header.
- Choose the trusted result: Use the Authentication-Results field whose authserv-id belongs to Yahoo. Earlier fields can have been added by intermediaries.
- Find the DMARC path: Confirm whether SPF or a different DKIM signature produced the matching authentication result.
- Map every signature: For each DKIM-Signature, record d=, s=, a=, c=, h=, and any t= or x= value.
- Check DNS: Query the exact selector host and confirm the key matches the active private key, meets Yahoo's length requirement, and was not revoked.
- Trace post-signing changes: Compare a copy captured immediately after the final signer with Yahoo's raw copy. Focus on the signed headers and body bytes after canonicalization.
- Send controlled tests: Send plain text and HTML through the same route, then test with optional footer insertion or link rewriting disabled.
- Confirm recovery: Retest at Yahoo, confirm DKIM passes for each expected signature, and watch DMARC aggregate data for the affected source.
DKIM checker
Check selector records and public key configuration.
?/7tests passed
Do not change p=reject or p=quarantine to p=none to diagnose this scenario. The message already has a DMARC pass, and the published policy applies when DMARC fails. Lowering enforcement does not repair DKIM or establish why Yahoo applied a policy rejection.
Keep the existing DMARC policy while repairing DKIM. If a separate investigation requires a policy change, assess spoofing exposure across the whole domain and use DMARC aggregate data before changing DNS.
How Suped fits into the fix
Suped is our DMARC and email authentication platform. For this Yahoo problem, Suped's product groups DMARC aggregate results by sending source so a team can see which source relies on SPF for its DMARC pass and which source has started failing DKIM.
Suped's DMARC monitoring helps map the failing source, monitor selector or DNS changes, and confirm whether the affected traffic recovers after a fix. Alerts are useful when a rotated selector disappears or a source begins signing with the wrong domain.
Issue steps to fix dialog showing the issue overview, tailored fix steps, and verification action
Raw-message investigation
- Header evidence: The raw Yahoo sample identifies the exact signature result and reason.
- Route evidence: Received fields and signer captures show where content changed.
- DNS evidence: Selector queries confirm the key available during testing.
Suped monitoring workflow
- Source mapping: Suped groups aggregate results by legitimate sending source.
- Change detection: Authentication trends show when DKIM failures begin or spread.
- Recovery check: Later reports confirm whether the repaired source passes again.
For agencies and managed service providers, the multi-tenant view keeps client domains separate while showing authentication health and issue priority. Raw message verification still happens outside aggregate DMARC data because aggregate reports do not contain the body needed to recompute a DKIM signature.
When the cause is not DKIM
A DKIM failure can appear beside a Yahoo rejection without being the only cause. The 554 5.7.9 response is broad. After fresh Yahoo samples show SPF, DKIM, and DMARC passing as expected, investigate the remaining policy signals.
- URL reputation: A new domain in links, redirects, image hosts, or tracking can introduce a separate reputation signal.
- Complaint behavior: High complaints or mail sent to people who did not request it can lead to spam placement or rejection.
- Message compliance: Malformed headers, missing required fields, or non-compliant message formatting can contribute to policy handling.
- Sending consistency: A sudden volume spike or a new sending IP can trigger closer review.
- Reputation status: A domain or IP on a blocklist, also called a blacklist, can add pressure when other defects are present.
Fix the measurable authentication defect first and retest with a simple message. If Yahoo still rejects a clean sample with the expected authentication results, use the exact SMTP diagnostic to investigate reputation, content, consent, and sending behavior.
Views from the trenches
Best practices
Keep a raw Yahoo sample before changing DNS so the failing signature can be inspected later.
Compare the SPF domain match and each DKIM result before changing DMARC enforcement.
Retest with plain text to isolate body rewriting and DKIM body hash breakage in transit.
Common pitfalls
Assuming a valid DKIM DNS record proves the signed message will verify at Yahoo.
Lowering DMARC policy even though the affected message already has a DMARC pass.
Ignoring a second signature when Yahoo evaluates every DKIM signature on the message.
Expert tips
Keep retired selector keys published until delayed mail can no longer reference them.
Use Yahoo's authserv-id to avoid trusting Authentication-Results added by another hop.
Treat 554 5.7.9 as a policy result and preserve the full SMTP diagnostic text from Yahoo.
Marketer from Email Geeks says SPF domain match should be checked first because DMARC can pass through SPF while DKIM still fails.
2022-07-28 - Email Geeks
Marketer from Email Geeks says a DKIM perm fail can come from a deleted public key, MTA configuration error, or DNS outage.
2022-07-28 - Email Geeks
The practical answer
Yahoo can report DKIM failure while SPF and DMARC pass because the results measure separate paths. SPF can satisfy DMARC when its authenticated domain matches the visible From domain. DKIM can still fail because signed content changed, the selector or key is wrong, a signature expired, DNS returned an unusable answer, or another signer added a broken signature.
Verify the actual Yahoo message rather than relying on a DNS record check. Preserve the bounce, choose Yahoo's Authentication-Results field, identify the DMARC pass path, inspect every DKIM signature, and trace changes after the final signer. Keep the DMARC policy in place. Suped's product can group the related DMARC data by source and monitor whether authentication recovers after the message-level fault is fixed.
