DKIM body hash mismatch: locate the message modification

Define the decision

A body-hash mismatch points toward a difference in the signed body representation, rather than simply a missing DNS selector. Gateways, disclaimers and message rewriting deserve investigation before key replacement.

Work through the procedure

1. Keep the original received message and the full signature result.
2. Identify where signing occurs in the transport path.
3. Compare a direct controlled route with the route that adds a disclaimer or rewrites content.
4. Move legitimate modifications before signing where the mail architecture supports it, then retest.

Worked example

The following is a synthetic example for this procedure, not a customer result or performance benchmark.

Path A: compose → sign → receive: DKIM passes
Path B: compose → sign → append legal footer → receive: body hash fails
Investigation: downstream footer service and signing order

Read the result

This is a controlled hypothesis, not proof that every footer breaks every signature. Canonicalization tolerates some representation differences, while substantive body changes can invalidate the signed content.

Check before moving on

1. Compare messages generated by the same sender configuration.
2. Record the canonicalization and signing domain for the failing sample.

Limits and next action

Do not weaken verification or remove required organizational controls just to make a test pass. Coordinate a transport-order correction with the mail administrator.

Source: RFC 6376: body hashing and canonicalization