# DKIM DMARC alignement fail for some messages

**URL:** <https://forum.dmarcian.com/t/dkim-dmarc-alignement-fail-for-some-messages/1818>\
**Category:** Technical Help\
**Created:** [June 24, 2022, 3:06pm UTC](https://forum.dmarcian.com/t/dkim-dmarc-alignement-fail-for-some-messages/1818 "2022-06-24T15:06:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chris](https://avatars.discourse-cdn.com/v4/letter/c/958977/32.png) [@Chris](https://forum.dmarcian.com/u/Chris)\
**Post date:** [June 24, 2022, 3:06pm UTC](https://forum.dmarcian.com/t/dkim-dmarc-alignement-fail-for-some-messages/1818/1 "2022-06-24T15:06:23Z")

</div>

Hi!,

 ![chrome_2022-06-24_16-43-17](https://canada1.discourse-cdn.com/flex036/uploads/dmarcian/original/1X/4703c892d713c25cf9f8afde1fe8785b71372bc2.png)

Can someone help me to understand why DKIM/DMARC alignement fail for 5 messages row n°1 since row n°2 seems identical and shows DKIM/DMARC aligned.

Thank you.

Chris

---

<div class="post-metadata">

**Author:** ![LinkP](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.dmarcian.com/linkp/32/142_2.png) [@LinkP](https://forum.dmarcian.com/u/LinkP)\
**Post date:** [June 24, 2022, 5:56pm UTC](https://forum.dmarcian.com/t/dkim-dmarc-alignement-fail-for-some-messages/1818/2 "2022-06-24T17:56:23Z")

</div>

Row 1 was not DKIM signed and row 2 was DKIM signed. I wouldn’t consider that identical. It’s probably time to check your mail server logs and see what they tell you.

---

<div class="post-metadata">

**Author:** ![Chris](https://avatars.discourse-cdn.com/v4/letter/c/958977/32.png) [@Chris](https://forum.dmarcian.com/u/Chris)\
**Post date:** [June 25, 2022, 6:35am UTC](https://forum.dmarcian.com/t/dkim-dmarc-alignement-fail-for-some-messages/1818/3 "2022-06-25T06:35:52Z")

</div>

I mean all the field values are identical (From:domain, IP, PTR/Server,…).

I set debug mode log for DKIM on our Exchange server and there are recurrent messages “DEBUG: Message is a System message or of TNEF format. Not signing”.

Can this 5 messages not DKIM signed related to NDR or autoreply messages ? [(https://github.com/Pro/dkim-exchange/issues/171)](https://github.com/Pro/dkim-exchange/issues/171)

Chris

---

<div class="post-metadata">

**Author:** ![Asher](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.dmarcian.com/asher/32/104_2.png) [@Asher](https://forum.dmarcian.com/u/Asher)\
**Post date:** [July 15, 2022, 12:26pm UTC](https://forum.dmarcian.com/t/dkim-dmarc-alignement-fail-for-some-messages/1818/4 "2022-07-15T12:26:59Z")

</div>

Hello Chris,

Judging by the SMTP mail-from domain identifier of the screenshot you provided, receivers checked SPF using the FQDN of the mail server, which typically means checking the HELO identify of the email. This occurs when the SMTP Mail From is null, or no email address given during the MAIL FROM SMTP command.

This is expected for system generated messages, such as delivery status notifications, out of office replies and the like. Exchange on prem is known to send some status messages in TNEF format, and this DKIM plugin does not appear to sign them.

> **[Configuration · Pro/dkim-exchange Wiki](https://github.com/Pro/dkim-exchange/wiki/Configuration)**
>
> DKIM Signing Agent for Microsoft Exchange Server. Contribute to Pro/dkim-exchange development by creating an account on GitHub.

Disabling TNEF may help, but likely not for all messages. You already have an SPF record published for your mail server’s hostname which brings those emails into DMARC compliance, following best practice and would have been my next recommendation.

---

<div class="post-metadata">

**Author:** ![Chris](https://avatars.discourse-cdn.com/v4/letter/c/958977/32.png) [@Chris](https://forum.dmarcian.com/u/Chris)\
**Post date:** [July 18, 2022, 2:35pm UTC](https://forum.dmarcian.com/t/dkim-dmarc-alignement-fail-for-some-messages/1818/5 "2022-07-18T14:35:26Z")

</div>

Thank Asher for you response.