--- title: "What happens to the emails that don’t pass the DKIM checks? | DuoCircle" description: "What happens to the emails that don’t pass the DKIM checks?" image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/email-security/what-happens-to-emails-failing-dkim-checks/" --- Quick Answer When an email fails DKIM, what happens depends on whether DMARC is in place and which policy you set. With no DMARC, receivers fall back to their own heuristics, often delivering with a lower reputation score. With DMARC, the DMARC policy decides: p=none delivers the message and sends an aggregate report; p=quarantine routes it to spam or junk; p=reject blocks delivery. Important nuance: DMARC passes if SPF or DKIM passes and aligns, so if SPF aligns, a DKIM failure alone does not fail DMARC. DKIM-only failures are most damaging when SPF also fails or is not aligned, which is common when mail goes through forwarders or third-party senders that break the original SPF path. What happens to the emails that don’t pass the DKIM checks? Your browser does not support the audio element. [ Download episode](https://media.mailhop.org/duocircle/images/2025/02/What-happens-to-the-emails-that-dont-pass-the-DKIM-checks.mp3) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Femail-security%2Fwhat-happens-to-emails-failing-dkim-checks%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=What%20happens%20to%20the%20emails%20that%20don%E2%80%99t%20pass%20the%20DKIM%20checks%3F&url=undefined%2Fblog%2Femail-security%2Fwhat-happens-to-emails-failing-dkim-checks%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Femail-security%2Fwhat-happens-to-emails-failing-dkim-checks%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Femail-security%2Fwhat-happens-to-emails-failing-dkim-checks%2F&title=What%20happens%20to%20the%20emails%20that%20don%E2%80%99t%20pass%20the%20DKIM%20checks%3F "Share on Reddit") [ ](mailto:?subject=What%20happens%20to%20the%20emails%20that%20don%E2%80%99t%20pass%20the%20DKIM%20checks%3F&body=Check out this article: undefined%2Fblog%2Femail-security%2Fwhat-happens-to-emails-failing-dkim-checks%2F "Share via Email") ![DKIM checks](https://media.mailhop.org/duocircle/images/2025/02/spf-validator-2323.jpg) Let’s do a quick recap of how [DKIM](/resources/what-is-dkim) works so that we can go further into knowing what happens to emails that don’t pass the DKIM authentication checks. _DKIM allows a domain owner to digitally sign all the emails going out of their domain so that receiving mail servers can check if the content was altered in transit_. To deploy DKIM, a pair of cryptographically secured public and private keys is generated. The public key is published on the domain’s DNS, and the domain owner stores the private key securely. When the receiving server gets the email, it retrieves the public key from the DNS and matches it with the [private key](https://www.techtarget.com/searchsecurity/definition/private-key) used to **sign the email**. When both the keys match, DKIM authentication passes, and the email lands in the inbox; otherwise, it fails. But what happens to the emails that fail the DKIM checks? This blog precisely answers that only. ## When DKIM fails and DMARC policy is present (combining SPF and DKIM results) It’s advised to **implement DKIM** in tandem with DMARC. This is because if DKIM fails, the receiving server will take the action you instructed through your DMARC record. There are three DMARC policies, one of which you can implement in your [DMARC record](/resources/dmarc-records). _Note: Please note that DMARC works on the basis of [SPF](/resources/what-is-spf) and DKIM results. If you have implemented only DKIM and DMARC for your domain, then DMARC results will only rely on DKIM authentication checks. In easier words, if you have only DKIM and DMARC in place, and an email didn’t pass the DKIM check, then it will fail the DMARC check as well._ _However, if your domain is protected with SPF, DKIM, and [DMARC](/resources/what-is-dmarc), DMARC depends on the results of both SPF and DKIM. For an email to pass DMARC, it should pass the checks for at least one of the protocols._ Here’s what each of the **policy instructs**\- ### p=none (None policy) It’s called the monitoring policy, as it instructs the receiving server to take no action against emails that fail the DKIM check. Such emails are usually delivered, but reports are sent to the domain owner so that they can **evaluate the details further**. [![DMARC Policy ](https://media.mailhop.org/duocircle/images/2025/02/spf-record-generator-3231.jpg)](https://media.mailhop.org/duocircle/images/2025/02/spf-record-generator-3231.jpg) ### p=qurantine (Quarantine policy) Under this DMARC policy, failed **emails are sent to the recipient’s** [spam or junk folder](https://cybernews.com/news/microsofts-breach-notification-emails-end-up-in-spam-folder/). ### p=reject (Reject policy) Under this [DMARC policy](/dmarc/dmarc-policy-guide-for-beginners/), the email that fails the DKIM check is rejected outrightly by the **receiving mailbox**. The email doesn’t even land in the spam folder; it simply bounces back to the sender. ## When DKIM fails but there is no DMARC in place _If DMARC is not in place, the email might still be delivered to the recipient’s inbox_. Depending on the **mail provider’s filtering rules**, it could be [marked as spam](https://www.infosecurity-magazine.com/news/60-emails-qr-codes-spam-malicious/) or junk. Some mail servers might reject it, but this is less common without DMARC. ## What are the possible reasons for DKIM failure? Apart from unmatched [digital signatures](https://www.digicert.com/faq/signature-trust/what-is-a-digital-signature), there are a few more **reasons why DKIM protocol** is triggered toward an email, even if it’s sent by a genuine person- ### Expiration of the DKIM signature This happens when an email is delayed or queued in the **spam filter** for a long time. _In such a case, it usually gets delivered after the x= timestamp has passed. x= is the expiration timestamp; so, if the current time exceeds this value, the signature is treated as expired, and DKIM fails because of it_. To avoid this, don’t set excessively short signature lifetimes unless you are dealing with a **high-security environment**. [![digital signatures](https://media.mailhop.org/duocircle/images/2025/02/what-is-dmarc-7310.jpg)](https://media.mailhop.org/duocircle/images/2025/02/what-is-dmarc-7310.jpg) ### Misconfiguration in DKIM setup Common misconfigurations in a DKIM setup include, typos in the [DNS record](https://www.cloudflare.com/learning/dns/dns-records/), use of an incorrect selector, or [DNS propagation](https://www.ibm.com/think/topics/dns-propagation) delays. Sometimes, the error occurs because of using corrupted or mismatched keys. That’s why it’s recommended that you **double-check DNS records** using online lookup tools. Also, validate the private and [public key](https://www.cloudflare.com/learning/ssl/how-does-public-key-encryption-work/) pair with OpenSSL. ### DKIM signature broken due to forwarding [Email forwarding](https://www.activecampaign.com/glossary/email-forwarding) systems and mailing lists often modify message content or headers, leading to DKIM failures. This can be prevented using ARCs or [Authenticated Received Chains](https://en.wikipedia.org/wiki/Authenticated%5FReceived%5FChain). What else you can do is **use the ‘rua’ tag** in your DMARC record to receive failure reports. If these reports are evaluated properly, they help enforce strict rejections if forwarding is common. ## Final words Being a domain owner or one of the **official email senders of a domain**, it’s your responsibility to ensure that you have properly configured DKIM so that your messages land in the inboxes. Failing DKIM alone doesn’t always mean rejection, but it significantly increases the risk of your email being flagged as suspicious. Have you run into any DKIM issues with your emails, or are you looking into **setting up DKIM for a domain**? Whatever the case is, [reach out to us](/contact) or schedule a demo with [DuoCircle](/) to get started. ## Topics DKIMDMARCSecurityspf ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) ## Related Articles [ Email Security 12m DMARC, SPF, and DKIM in 2026: Why Email Authentication Is Now a Regulatory Requirement, Not Just a Best Practice Apr 29, 2026 ](/blog/dmarc-spf-dkim-2026-email-authentication-regulatory-requirement-best-practice/)[ Email Security 5m Email Monitoring Tools: A Complete Guide to Protecting Your Email Ecosystem May 7, 2026 ](/blog/email-monitoring-tools-guide-protecting-your-email-ecosystem-security/)[ Email Security 6m 3 emerging AI-powered cyber threats and how to stay protected from them in 2025 Jun 27, 2025 ](/blog/email-security/3-ai-powered-cyber-threats-2025-and-how-to-stay-safe/)[ Email Security 6m 5 efficient email security techniques for advanced persistent threats Dec 3, 2024 ](/blog/email-security/5-efficient-email-security-techniques-for-advanced-persistent-threats/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"What happens to the emails that don’t pass the DKIM checks?","description":"What happens to the emails that don’t pass the DKIM checks?","url":"https://www.duocircle.com/blog/email-security/what-happens-to-emails-failing-dkim-checks/","datePublished":"2025-02-18T19:55:06.000Z","dateModified":"2025-04-09T13:19:01.000Z","dateCreated":"2025-02-18T19:55:06.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/what-happens-to-emails-failing-dkim-checks/"},"articleSection":"email-security","keywords":"DKIM, DMARC, Security, spf","wordCount":817,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2025/02/spf-validator-2323.jpg","caption":"DKIM checks","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Email Security"},{"@type":"ListItem","position":3,"name":"What happens to the emails that don’t pass the DKIM checks?","item":"https://www.duocircle.com/blog/email-security/what-happens-to-emails-failing-dkim-checks/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Email Security","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"What happens to the emails that don’t pass the DKIM checks?","item":"https://www.duocircle.com/blog/email-security/what-happens-to-emails-failing-dkim-checks/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"What happens to the emails that don’t pass the DKIM checks?","description":"What happens to the emails that don’t pass the DKIM checks?","url":"https://www.duocircle.com/blog/email-security/what-happens-to-emails-failing-dkim-checks/","datePublished":"2025-02-18T19:55:06.000Z","dateModified":"2025-04-09T13:19:01.000Z","dateCreated":"2025-02-18T19:55:06.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/what-happens-to-emails-failing-dkim-checks/"},"articleSection":"email-security","keywords":"DKIM, DMARC, Security, spf","wordCount":817,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2025/02/spf-validator-2323.jpg","caption":"DKIM checks","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```