Lead with a reproducible statement

Open with one sentence: “Messages from account A through route B at 14:00–14:20 UTC carried d=example.com; s=s1, and receiver C reported dkim=fail (body hash did not verify).” If the reason is not reported, say only dkim=fail. Avoid “all DKIM is down” unless scope evidence supports it.

Include the provider message identifier, your internal correlation identifier, UTC timestamps, sending region or endpoint, template/workflow, and whether the issue is continuous or intermittent. Do not include API credentials or reset links.

Add the minimum authentication extract

Provide the DKIM-Signature tags needed to identify and reproduce the check: v, a, c, d, s, h, bh, and timing tags where present. The signature value b= and body may be sensitive and often are not needed for an initial routing/configuration investigation; share raw material only through an approved secure channel when the provider confirms it is necessary.

Add the trusted receiver’s Authentication-Results line and identify the receiving system that added it. Remove recipient local parts and unrelated authentication fields if they are outside scope.

Capture DNS and path evidence

Record the exact selector query, authoritative and recursive outcomes, TTLs, resolver, and query time. State whether the record is TXT or CNAME and include a public-key fingerprint or bounded record where policy permits—never the private key.

Describe systems that may modify content after signing: outbound gateways, footer services, mailing-list software, or security products. Compare one working message if available using the same fields.

Provide a safe reproduction

List steps that use an authorized test recipient and non-sensitive template. State expected and observed results. Note recent key rotations, DNS changes, template changes, or gateway deployments with exact times and rollback status.

Preserve the outcome

When support replies, distinguish confirmed cause from recommendation. Retest a fresh message through the complete path and attach the new trusted result. Update the sender inventory and runbook with the final owner and fix. A good handover lets support start at the failing boundary while keeping customer content and secrets out of ordinary tickets.