Shopify/SendGrid DKIM Fail 'temperror'

Technical Help
1

Hi all

I am having a terrible time trying to figure out what could possibly be causing this particular scenario where my Domain Report says Shopify Inc has 50% DKIM alignment (1 of 2 emails).

When I look at the raw XML, both emails have source_ip that belong to SendGrid (Shopify uses SendGrid API).

Note that I have confirmed with Shopify that all of my DMARC records are correctly configured in DNS and they have validated them with their tooling.

Would anyone have any ideas, or like to speculate, what might be happening here? I donā€™t understand why some SendGrid IPs pass and others fail.

Thanks in advance

dmarcian-1
dmarcian-11748Ɨ672 101 KB

dmarcian-2
dmarcian-21674Ɨ529 93 KB

raw-xml-2
raw-xml-2715Ɨ490 56.4 KB

raw-xml-1
raw-xml-1715Ɨ834 100 KB

5

I had a similar issue with SendGrid and Stamped.IO. Both were trying to use the same CNAME entry. Found an article on how to set custom CNAME selectors for SendGrid, leaving the default selectors for Stamped.IO. Both have been at or near 100% alignment after this change.

6
1 Like
7

Isnā€™t the answer simply: one of the two mails were processes by the receiver with a failing DNS response for the DKIM record, see the ā€œtempfailā€ in the raw xml.

BTW: By expanding the ā€œ+ *.shopify.comā€ you should see two records and get a readable form of the differences of the two mails (ā€œUnique IP Count=2ā€ shows that they were sent via two different servers}.

8

Thanks KJessel

I might not have been clear but Shopify seems to use SendGrid API for mail but I have no control of that beyond my SPF, DKIM & DMARC records.

Unlike an account with SendGrid where Iā€™m sure you can be very particular with the settings, like the selector.

9

Thank you, ronvdburg. Good tips.

Iā€™m not sure what this tells me other than what you said (it failed to get a DNS response from GoDaddy?)

2-ips
2-ips1332Ɨ324 53.7 KB

10

Sendgrid allows you to configure custom selectors. If Spotify is like Stamped.IO, you must use the default SendGrid selectors, which causes the conflict. Change the SendGrid selectors to custom, and the conflict is resolved.

11

Thanks KJessel but I donā€™t even have a SendGrid account. Shopify uses the SendGrid API to send mail but thereā€™s nowhere in the Shopify platform to ā€œcustomiseā€ the selectors for the SendGrid implementation. Oh well.

Hopefully itā€™s something else causing it because if itā€™s what youā€™re saying it might be then thereā€™s no solution from what I can tell.

Thanks anyway

12

Sorry for not responding earlier.
You have a good point with ā€œIā€™m not sure what this tells me other than what you said (it failed to get a DNS response from GoDaddy?)ā€.
Indeed it doesnā€™t tell you a great amount, but you see that server o37 (actually 149.72.116.219) was correctly processing both SPF and DKIM; but it was server o39 having the ā€œtemperrorā€.
The ā€œtemperrorā€ tells you that it is not a structural/persistent error.
So, you could regard it as a one-time glitch.
On the other hand, if it bothers you, or you ā€˜just want to understandā€™, or if this glitch is intermittent, then you could check other reports whether the temperror only happens with server o39, or with others also.
Just thinking out-of-the-box, it could also be explained by a change in the DKIM DNS record at the time of processing in o39.

13

Hmm, that I find difficult to believe. If the selector was the issue, then I would expect that mail from all shopify servers would fail. Not only o39.mailer.shopify.com but also for o37.

14

Excellent, and thank you. I tend to agree with it being a one-off but I have seen it with other servers too. Iā€™ll keep monitoring, maybe the issue will subside on its own.