📝 Originally published (in Japanese) at forge.workstyle.tech.

TL;DR After an NS migration, mail was delivered but DKIM failed four days later. SPF passed, and the DMARC policy was p=none. Comparing all records with dig showed that the new DNS was missing one DKIM TXT record.

TL;DR

After migrating nameservers, DKIM was failing because the new DNS was missing a TXT record used by the mail server for DKIM. Before removing the old DNS, I compared all the records, added the missing one, and confirmed DKIM=pass with a sending test. DKIM was still failing even though SPF passed and DMARC was set to p=none.

Why Was Only DKIM Failing?

Comparing all the records on the old and new DNS servers with dig, I found that the new DNS was missing only the TXT record for the mail server’s DKIM. The NS records had been moved four days earlier. Emails were getting through, and SPF was passing. DMARC was set to p=none, so emails weren’t being rejected.

Knowing that SPF was passing didn’t alert me to the missing DKIM TXT record. I didn’t verify exactly how many DKIM checks had failed. The records show that DKIM failures were occurring and that I had missed copying one TXT record. The number of failures is unknown.

What I Checked After Adding the TXT Record

I added the missing TXT record and ran a sending test. The result was DKIM=pass. The value was 408 characters long and matched exactly.

I found the omission while comparing all the records before deleting the old DNS entries, not during the sending test. Even when you think you’ve copied every record, it’s easy to miss one. Because DMARC was set to p=none, the DKIM failure wasn’t obvious. Since I didn’t check the number of failures, I don’t know how much impact it had. The fact that emails are getting through doesn’t prove there’s no problem.

Diff All Records Before and After an NS Migration

The lesson from this experience: mechanically diff all records in the old and new DNS before and after an NS migration.

Even if you think you’ve checked every record one by one, it’s easy to miss something when there are many. If you compare records captured before and after the migration and make the differences easy to inspect, you’re more likely to catch omissions. SPF passing and DKIM passing are separate things. When DMARC is set to p=none, messages may not be rejected even if DKIM fails. So don’t stop checking just because email is being delivered; compare the DNS records themselves.

Key takeaways

  • Compare all records in the old and new DNS with dig before removing the old DNS.
  • Check for the DKIM TXT record in the new DNS instead of relying only on SPF results.
  • Add the missing TXT record and confirm DKIM=pass with a sending test.
  • Verify that the old and new record values match; the value in this case was 408 characters and matched exactly.
  • If you have not checked the number of DKIM failures, the number of affected messages is unknown.