I just registered after using the site for some time and my registration email from [email protected] got marked as spam by my mail server. I have somewhat aggressive settings, but it looks like there's something going on with either the OpenDKIM DNS TXT record or the actual key. My logs are below:

opendkim[14223]: A037FE1605: not authenticated

opendkim[14223]: A037FE1605: bad signature data

postfix/qmgr[7489]: A037FE1605: from="[email protected]"

Here is the relevant header info from the message

<br><br>Authentication-Results: dkim=fail reason="signature verification failed" (1024-bit key) header.d=serverfault.com [email protected] header.b=J2pWFCFJ DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=serverfault.com; s=dk; h=Content-Type:Message-ID:Date:Subject:Reply-To:To:From:MIME-Version; <br> Received: from [] (helo=[]) by mx-out.stackexchange.com with esmtp (Exim 4.72) (envelope-from <[email protected]>) id 1Z31fJ-0007sr-TN; Thu, 11 Jun 2015 12:33:01 +0000 –
  • 7
    So you expect Stack Exchange to sign their emails with DKIM and any other thing as soon as it's being developed? I don't think they should. If one want to get emails, he/she shouldn't use super-ultra-aggressive filters. Simple as that. Jun 11, 2015 at 14:14
  • 5
    It's not that I expect the emails to be signed, they are currently being signed and there is an issue with either the DNS record for the signature or the signature itself.
    – red_shift
    Jun 11, 2015 at 15:31
  • It's nice when DKIM works, but unfortunately all too often it doesn't work. Jun 11, 2015 at 15:33
  • 7
    This is a valid report that someone could conceivably learn something from - the way red_shift receives email is quite incidental once you consider that.
    – user50049
    Jun 11, 2015 at 17:01
  • What, Tim, you expect people to be polite all the time? ;)
    – Joe
    Jun 11, 2015 at 17:16
  • 2
    @ShadowWizard If the DNS records or the headers in the mail itself indicates that it is supposed to be signed, then it is sensible to expect the mail to carry a valid signature.
    – kasperd
    Jun 14, 2015 at 19:58
  • Hmm, yep that should be working right. And does for stackexchange.com but not serverfault.com. I'll take a look at the setup tomorrow.
    – Zypher
    Jul 10, 2015 at 2:36

1 Answer 1


This is now fixed. The public key in our dns txt record was wrong for serverfault.com.

I've updated the record and tested that DKIM is now passing.

  • 1
    This was some time ago but thank you for fixing the issue!
    – red_shift
    Dec 9, 2015 at 0:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .