Problem with DKIM associated domains

[MCORLOU]

Hello,

I've got a problem with my DKIM on associated domains. When people receive mail from us, for parent domain no problem, i've :

dkim=pass (signature was verified)

but for associated domains dkim can't be verify, i've :
dkim=fail (signature did not verify)

i've the same key on all my parent and associated domain, In Domain "DKIM signing for outgoing email" is enable, an in session "Enable DKIM signing for outgoing messages" is also enable.

Could you tell me what is wrong in my settings ? 

Thanks

[AEK]

Hello

• When you show the source of the received mail (mail headers) for the mails that are sent from the associated domains, do you see the DKIM signature as for the mails from the parent domain?
• Is the DKIM selector in mail headers looks the same as the DNS record name of the DKIM public key?
• Do you see this behavior when you send to other mail servers (like gmail and others)?
• Have you enabled DKIM signing for all domains under menu Domains & Users > Domains? And for all outgoing session profiles?
• Can you ask the remote admins to check further in the mail gateway logs to try find more logs about the DKIM failure? I mean to see if the signature was wrong, if the selector was not found in the public DNS, or any other relevant logs
• Can you ask the remote admin to run dig/nslookup from his side to check if he can see the selector on your public DNS? (like dig selector._domainkey.example.com)

[MCORLOU]

Hello

• When you show the source of the received mail (mail headers) for the mails that are sent from the associated domains, do you see the DKIM signature as for the mails from the parent domain?
  • Yes i see it with the good selector 
• Is the DKIM selector in mail headers look the same as the DNS record name of the DKIM public key?
  • Exactly the same
• Do you see this behavior when you send to other mail servers (like gmail and others)?
  • Try with M365 and Gmail same behavior, and all serious provider also.
• Have you enabled DKIM signing for all domains under menu Domains & Users > Domains? And for all outgoing session profiles?
  • Yes and Yes
• Can you ask the remote admins to check further in the mail gateway logs to try find more logs about the DKIM failure? I mean to see if the signature was wrong, if the selector was not found in the public DNS, or any other relevant logs
  • I'm the administrator for the fortimail and M365, no problem in log

I'v read this on internet, is that true ? no dkim for associated domains ? 
https://www.fortinetguru.com/2016/04/configuring-mail-settings/7/

[AEK]

Hello Mcorlou

Sorry I just released now that you are using associated domains while I thought before that you where using protected domains (I confused them). In fact I didn't used them before but instead I always configured the additional domains as protected domains, that's why I didn't have issues with DKIM for additional domains.

Regarding associated domains, I can read in admin guide that the associated domain uses the same DKIM as the parent.

FortiMail performs DKIM signing for an associated domain with its parent domain DKIM key. You must publish the DKIM public key for the associated domain in order for the receiving MTA to validate the DKIM signature.

Ref:  https://docs.fortinet.com/document/fortimail/7.4.2/administration-guide/40774/configuring-protected-...

So I understand from this (and I guess you agree) that you have to insert the same dkim public key in DNS of the protected domain and DNS of the associated domains.

Like this, on main domain:

default._domainkey.maindomain.com. 14400 IN TXT "v=DKIM1; k=rsa; p=XYZ..."

And on associated domain:

default._domainkey.associateddomain.com. 14400 IN TXT "v=DKIM1; k=rsa; p=XYZ..."

If this is what you did than please try send an e-mail to mail-tester.com from an associated domain and then the diagnostic it provides about your dkim signing. I hope it will provide further information about your issue.

You may also check if the dkim public key record is valid using this tool: https://dkimcore.org/tools/keycheck.html

Hope it helps.

[MCORLOU]

Problem solved, there was an error in the DKIM key declaration on the DNS zone... some one as made a bad copy/paste.

Thank you for your time