DKIM 'temperror' result in Outlook.com DMARC Reports
Introduction
In recent years, email administrators have been encountering unusually high rates of DKIM authentication failures in DMARC reports from Microsoft's Outlook.com. These failures are labeled temperror and signify temporary DNS lookup issues, which Microsoft has acknowledged and is working to resolve. In this post, we’ll explain what this error means, why it’s happening, and how administrators should interpret and respond to these reports.
What is DKIM and Why Does 'temperror' Appear in DMARC Reports?
DKIM (DomainKeys Identified Mail) is an essential component of email security. It uses cryptographic signatures to verify an email's authenticity and ensure it hasn’t been altered in transit. When a DKIM check fails, it’s reflected in the DMARC report.
The temperror status in DMARC reports indicates that Microsoft encountered an issue when attempting to perform a DNS lookup to validate the DKIM signature. This can occur due to various factors, such as an overburdened DNS server, a temporary connectivity problem, or, as Microsoft has pointed out, a more specific challenge in their DNS processing infrastructure.
Why Microsoft’s DKIM 'temperror' is Significant
Although a temperror typically points to a temporary issue, its frequent appearance can be problematic for email senders. A series of temperror results can distort DMARC reports, giving a misleading view of your domain’s authentication performance. While a temperror doesn't signal a permanent failure, it can still affect email deliverability. If SPF (Sender Policy Framework) fails or is misaligned, legitimate emails might be marked as unauthenticated, leading to potential delivery issues.
The Numbers Behind the Issue
When analyzing DMARC reports from the last 30 days, one fact stands out: Microsoft’s platform is responsible for nearly all DKIM temperror issues. This data comes from aggregate reports submitted by over 20,000 domains, offering a comprehensive and reliable view of the problem’s scale.
Here’s how the numbers break down by email provider:
Provider | Temperror Emails | Total Emails Processed | Temperror % |
|---|---|---|---|
Outlook.com | 4,530,744 | 440,722,987 | 1.0280 |
Enterprise Outlook | 179,262 | 222,003,974 | 0.0807 |
Yahoo | 52,496 | 174,496,158 | 0.0301 |
GMX | 834 | 13,472,947 | 0.0062 |
Mimecast | 30 | 19,934,355 | 0.0002 |
seznam.cz a.s. | 0 | 53,187,154 | 0.0000 |
comcast.net | 0 | 11,108,130 | 0.0000 |
google.com | 0 | 2,797,396,688 | 0.0000 |
What Does This Mean?
- Microsoft Outlook.com generated over 4.5 million DKIM temperror events out of more than 440 million emails, for a rate of just over 1%.
- Enterprise Outlook produced almost 180,000 temperror events, though its rate is far lower at 0.08%.
- All other major providers, including Gmail, GMX, Mimecast, seznam.cz, and Comcast, recorded zero or nearly zero DKIM temperror events, with rates so low they are statistically insignificant.
Why Are These Errors Happening?
A DKIM temperror means the receiving system could not validate the DKIM signature due to a temporary failure. Most often, this is caused by a DNS lookup failure or timeout. Microsoft’s infrastructure appears to encounter these much more frequently than any other major provider, resulting in this consistently high rate of temperror events.
Why Does This Matter?
- Legitimate emails may fail authentication on Microsoft’s side, even if everything is configured correctly by the sender.
- False positives in DMARC reports can cause confusion and unnecessary troubleshooting.
- Inbox trust issues if IT teams see a high volume of these errors in their reporting.
Stricter Requirements for High-Volume Senders
Microsoft recently introduced stricter authentication requirements for high volume senders, mandating that all messages pass SPF, DKIM, and DMARC checks to avoid being sent to the junk folder or blocked. While these changes are intended to strengthen email security, they may also amplify the impact of Microsoft’s ongoing DKIM temperror issues. As a result, legitimate senders could experience unexpected deliverability problems, even if their email is properly configured, simply due to the issues within Microsoft’s infrastructure.
Final Recommendation
To make sure your email authentication setup is correct, use learnDMARC.com for a thorough check of your SPF, DKIM, and DMARC configuration. If your domain passes all tests there, you can confidently ignore any DMARC report errors from Microsoft. In most cases, the issue is not with your setup, but with Microsoft’s infrastructure.authentication setup!