220-1101 Question 115
Single answerDomainKeys Identified Mail (DKIM)A small business recently moved its outbound email to a cloud email provider. Soon after, several customers report that messages from the company are landing in spam folders. The help desk verifies that messages are being sent successfully, but a message trace shows "DKIM=fail" on outbound mail. The domain's DNS records were not fully reviewed during the migration. Which action is the BEST next step to resolve this issue?
- A
Create or correct the DKIM public key TXT record in DNS for the selector used by the cloud email provider
- B
Disable SPF so receiving mail servers will rely only on DKIM validation
- C
Install a new SSL certificate on the company web server so mail gateways trust the domain
- D
Change the users' email passwords and re-add the accounts to their mail clients
Show answer and explanation
Correct answer: A
Explanation
DKIM helps receiving mail servers verify that an email was authorized by the sending domain and that key parts of the message were not altered after signing. In a migration to a new email provider, a common real-world problem is that the provider begins signing mail with its private key, but the organization's DNS still lacks the matching public key record or contains an outdated one. That causes receiving systems to mark mail as DKIM=fail, which can contribute to spam filtering. The best corrective action is to publish the correct DKIM TXT record for the selector specified by the provider. This aligns with standard vendor documentation from major email platforms, which typically requires administrators to enable DKIM signing and publish provider-generated DNS records. Best practice is also to verify SPF and DMARC after the change, but the direct fix for a DKIM failure caused by incomplete migration is to correct the DKIM DNS record.
- A. Correct.
Correct. DKIM works by having the sending system sign outgoing messages with a private key, while receiving servers validate the signature by looking up the corresponding public key in DNS, typically as a TXT record under a selector such as selector1._domainkey.example.com. If the company migrated to a new provider and the DNS DKIM record is missing, incorrect, or still points to the old provider's key, receiving servers can report DKIM failures. Updating or creating the correct DNS record is the most appropriate next step.
- B. Incorrect.
Incorrect. SPF and DKIM are separate email authentication methods, and disabling SPF would not fix a DKIM failure. In fact, removing SPF could make deliverability worse by reducing the domain's overall email authentication posture. A common misconception is that one email authentication method can simply replace another, but best practice is to configure SPF, DKIM, and often DMARC together.
- C. Incorrect.
Incorrect. SSL/TLS certificates on a web server do not provide the DNS-based public key used for DKIM validation. This distractor is plausible because certificates are also used for cryptographic trust, but DKIM specifically depends on a DNS-published public key for email signing validation, not the website's HTTPS certificate.
- D. Incorrect.
Incorrect. User passwords and local mail client configuration generally do not affect whether a receiving server can validate a DKIM signature on outbound mail. Someone might choose this if they confuse sending/authentication issues at the client level with domain-level email authentication. DKIM failures are typically caused by signing configuration, message modification in transit, or incorrect DNS records.