Billionmail/BillionMail · error

Invalid DKIM record format

Error message

Invalid DKIM record format

What it means

Thrown when the quoted-segment regex matches fewer than 2 segments in the DKIM record text, meaning the content does not contain a properly wrapped multi-part DKIM record (quote-wrapped chunks including the p= key). The library expects rspamd's record format of multiple quoted lines.

Source

Thrown at core/internal/service/domains/domains.go:670

	// If the raw public key is read, format it into DNS TXT record format
	if !strings.Contains(dkimRecord, "v=DKIM1") && !strings.Contains(dkimRecord, "k=rsa") && !strings.Contains(dkimRecord, "p=") {
		// Remove possible header/footer markers and newlines
		dkimRecord = strings.ReplaceAll(dkimRecord, "-----BEGIN PUBLIC KEY-----", "")
		dkimRecord = strings.ReplaceAll(dkimRecord, "-----END PUBLIC KEY-----", "")
		dkimRecord = strings.ReplaceAll(dkimRecord, "\n", "")
		dkimRecord = strings.TrimSpace(dkimRecord)
		dkimRecord = fmt.Sprintf("v=DKIM1; k=rsa; p=%s", dkimRecord)
	} else {
		var ms [][]string
		ms, err = gregex.MatchAllString(`"([^"\r\n]+)"`, dkimRecord)
		if err != nil {
			err = fmt.Errorf("Failed to parse DKIM record: %v", err)
			return
		}

		if len(ms) < 2 {
			err = fmt.Errorf("Invalid DKIM record format")
			return
		}

		s := ""
		for _, v := range ms {
			if len(v) < 2 {
				continue
			}
			s += v[1]
		}

		dkimRecord = s
	}

	record = v1.DNSRecord{
		Type:  "TXT",
		Host:  selector + "._domainkey",
		Value: dkimRecord,

View on GitHub (pinned to fc36c76c05)

Solutions

1. Regenerate the DKIM keys/config via RepairDKIMSigningConfig so the record is written in the expected quoted format
2. If storing a raw base64 key, ensure it is quote-wrapped per the expected format, or place it on the code path that prepends v=DKIM1; k=rsa; p= directly
3. Inspect the file at dkimPubPath and compare with a healthy domain's record format
4. Restore the file from a backup if it was hand-edited

Example fix

// before: bare key in record file fails the quoted parse
MIIBIjANBgkqh...
// after: expected quoted format
"v=DKIM1; k=rsa;"
"p=MIIBIjANBgkqh..."

if strings.Count(dkimRecord, "\"") < 4 {
    return fmt.Errorf("DKIM record not quote-wrapped in expected format — regenerate via RepairDKIMSigningConfig")
}

func isQuotedDKIMRecord(s string) bool {
    return strings.Count(s, "\"") >= 4 && strings.Contains(s, "p=")
}

if len(ms) < 2 {
    log.Printf("invalid DKIM record format: %q — expected multiple quoted segments", truncate(dkimRecord, 80))
    return fmt.Errorf("Invalid DKIM record format")
}

When it happens

Trigger: The dkimRecord string read from the key/record file has zero or one quoted section — e.g. file contains a raw base64 key (no quotes), an empty file, a single-line record, or hand-edited content without the standard quoted wrapping.

Common situations: Admin replaced the key file with a bare public key, a script wrote the key without quote-wrapping, key file truncated or empty after failed generation, or rspamd version emitting a differently formatted record.

Related errors

• Failed to parse DKIM record: %v
• error reading CSV file: %v
• failed to read CSV headers: %v
• No SPF record found (from cache)
• No SPF record found

AI-assisted analysis of Billionmail/BillionMail@fc36c76c05 (2026-09-05). Data as JSON: /api/errors/31403ea5cf0e49bd. Report an issue: GitHub.