Direct answer

A DKIM body-hash failure means the canonicalized received body did not match the signed bh= value. It is separate from finding the public key. This working article is prepared from primary technical material and remains an editorial draft until its claims and examples are reviewed. The intended outcome is straightforward: Explain how post-signing content changes can break body verification while the key remains published.

Before acting, write down the exact identifier, message, provider, and UTC observation time involved. That small evidence boundary prevents a general domain assumption from replacing the result of the actual check. It also gives the next reviewer enough context to repeat the work without seeing unrelated recipient data or credentials.

Prepare the evidence

Use information you are authorized to inspect. Preserve exact protocol values such as domains, selectors, IP addresses, tags, and response classes, but redact local parts, API keys, cookies, mailbox credentials, and unrelated content before sharing. Name the source of each observation and keep unavailable sources outside any passing or not-listed total.

The preparation should answer four questions: what was tested, which system made the observation, when it was observed, and what the observation cannot prove. If any answer is missing, record the gap instead of filling it with a guess.

Work through the method

  1. Preserve an original signed fixture and its expected verification result.
  2. Change one body byte through a controlled transformation.
  3. Verify the unchanged selector and key location.
  4. Compare body-hash and signature outcomes without exposing a real message.

Keep each step reversible. When the method calls for a change, record the previous value, owner, intended effect, and rollback condition. Send or query again only after the change is in effect, and use a fresh message or logical run when the evidence belongs to a new event.

Worked example

A footer is inserted after signing. DNS still returns the same key, but the modified body no longer matches the signed hash.

Write the example as an identity-and-evidence table when several domains or providers are involved. A reader should be able to point to the field supporting each conclusion. If the evidence supports several explanations, list those explanations and the next observation that would distinguish them.

Interpret the result

Separate a protocol fact from a product status and from an operational recommendation. A record can be present while a message fails; a server can accept a message without placing it in the inbox; and a source can be unavailable without returning a clean result. Preserve complete, partial, unknown, unavailable, and failed outcomes as different states.

Use the result to choose one next check. Repeating an unrelated checker or changing several DNS records at the same time usually reduces the value of the evidence. Where a plan allowance applies, retries with the same logical submission should follow the documented idempotency behavior rather than creating duplicate work.

Limits and failure cases

Canonicalization can tolerate specific whitespace changes, and a full verifier must implement the signature algorithm correctly. Results also age: DNS, keys, provider policies, list entries, message paths, and account configuration can change after the observation. Do not turn this bounded evidence into a guarantee of future delivery, mailbox ownership, universal reputation, or logo display.

An empty, timed-out, or unsupported observation should remain unknown or unavailable. It should never be rewritten as pass, valid, or not listed merely to make a report look complete.

Next useful action

Inspect an affected original message and trace transformations between signer and receiver. Retain the report identifier and the smallest redacted evidence needed for comparison. If the result changes a published instruction, create a reviewed content revision and flag dependent translations instead of silently rewriting them.

Primary references for review

These links support the technical review of this draft. Their presence is not a claim that an accountable reviewer has approved every sentence, provider behavior, or localized version.