Solution:
Root Cause: Email Content or Headers Altered In-Transit
DKIM authentication calculates a cryptographic hash of the email body (
bh=) and selected headers. A
body hash did not verify error occurs when an intermediate mail transfer agent (MTA), security gateway, anti-spam scanner, or footer-appending proxy alters body bytes or line endings after signing.
Step-by-Step Fix:
1.Audit Mail Gateway & Relays:
Disable automated footer injection, corporate disclaimers, or line-ending (CRLF) conversions on outgoing relays.Ensure downstream security appliances re-sign emails AFTER applying content modifications.2.Configure Canonicalization to Relaxed:
In your mail server or ESP settings, set DKIM canonicalization to relaxed/relaxed instead of simple/simple (simple fails on minor whitespace adjustments).3.Standardize Character Encoding:
Ensure your application sends outbound mail with standard UTF-8 and quoted-printable encoding to prevent byte alterations during transport.