What Does "temperror" Mean in Your Yahoo DMARC Report When DKIM Passes?

If you monitor your Yahoo DMARC reports closely, you may have noticed something that looks contradictory at first: DKIM shows a pass, but the aligned DKIM signature reports a temperror. You are not misreading the report. Both can appear together, and the reason is structural rather than alarming.

This post explains what those fields mean under RFC 8601, why pass and temperror are not competing signals, and what you should do when you see this combination in your own reports.

How Yahoo formats DKIM results in Auth-Results headers

When Yahoo receives an inbound message, it runs DKIM verification and records the result in an Authentication-Results header, as specified in RFC 8601. That data feeds into the aggregate DMARC report Yahoo sends back to you.

RFC 8601 records two separate DKIM-related measurements. First, the basic DKIM result: did the cryptographic signature verify? Second, the aligned DKIM result: does the DKIM-signing domain match the domain in the message From: header? Both matter for DMARC purposes, and both appear in your aggregate reports.

Here is a simplified example of how that looks in an Authentication-Results header:

Authentication-Results: mx.mail.yahoo.com;
  dkim=pass header.i=@sendingexample.com;
  dkim=pass body.i=@sendingexample.com;
  SPF=pass

In this example from RFC 8601, the dkim=pass lines indicate the signature verified correctly. The header.i and body.i fields show which domain identity was evaluated for each DKIM signature. If Yahoo could not complete the alignment check for a particular signature, that aligned result would show temperror instead of pass.

What "temperror" actually means

RFC 8601 defines five DKIM result values:

• pass - the DKIM signature verified correctly
• fail - the signature failed cryptographic verification
• none - no DKIM signature was present on the message
• temperror - the verification could not be completed due to a temporary condition; retry may succeed
• permerror - the DKIM record is fundamentally misconfigured and will never verify

temperror is not a DKIM failure. It is a temporary blockage of the verification process itself. The most common causes are:

• A DNS lookup for the DKIM selector record timed out or returned SERVFAIL
• The selector record was published but had not yet propagated to Yahoo's resolver at check time
• DNSSEC validation of the selector record encountered a transient failure
• Yahoo's verification infrastructure hit a brief internal error during the alignment check

The key point is that an aligned DKIM temperror means Yahoo could not complete the alignment verification, not that your DKIM signature is broken.

Why pass and temperror appear together in the same report

Yahoo assesses DKIM for both the header domain (the domain in the DKIM-Signature's i= tag) and the body domain (the domain used for the message body hash). Each assessment is recorded separately. If the header DKIM signature passes cryptographic verification but Yahoo's lookup for the aligned selector record returned a SERVFAIL or timed out, the aligned check returns temperror while the basic DKIM check still shows pass.

The cryptographic signature is valid. The alignment check simply could not run to completion. This is why dkim=pass alongside adkim=temperror in the same aggregate report is not inconsistent. They are measuring different things at different points in the verification chain.

Common causes of persistent aligned DKIM temperror

Most transient temperror events clear within minutes as DNS propagates or Yahoo retries. If you are seeing aligned DKIM temperror consistently across multiple reports, the likely causes are:

Selector record DNSSEC issues - If your DKIM selector record is DNSSEC-signed but Yahoo's resolver cannot validate the chain, the aligned check may return temperror. Check your selector's DNSSEC status using dnsviz.net or by querying with dig +dnssec.

Selector published at the wrong subdomain - DKIM selectors are referenced by their full name (for example, selector1._domainkey.example.com). If the selector DNS record exists but is published under the wrong parent domain, Yahoo's alignment check cannot match it to your From: domain. The result may be temperror rather than a clean fail, depending on where the lookup stopped.

Firewall or routing issues at your DNS provider - Some DNS providers handle large query volumes or specific record types inconsistently. If your selector record's authoritative nameservers return SERVFAIL intermittently, Yahoo will report temperror.

TTL expiry during key rotation - When rotating DKIM keys, the old selector remains valid in Yahoo's DNS cache until its TTL expires. If you update the selector record before the old TTL expires, Yahoo may receive inconsistent answers during the transition window.

How to correlate the report with actual email headers

Aggregate DMARC reports give you the overview. To diagnose a specific instance, look at the Authentication-Results header in the actual message that triggered the temperror. That header tells you which selector was used (the s= field in DKIM-Signature), which domain signed it (the i= tag), and what each check returned.

You can get this by sending a test message from your domain to a Yahoo address you control and examining the raw headers on receipt. Compare the selector name and signing domain in the message to what you have published in DNS.

Does this affect your DMARC alignment?

For DMARC purposes, an aligned DKIM temperror is treated differently than an aligned DKIM fail. RFC 7489 treats temporary errors as inconclusive rather than definitive failures. If your DKIM setup is otherwise correct and the signing domain aligns with your From: domain, a single temperror on the aligned check will not cause a DMARC failure on its own.

The practical risk is low if your DKIM is fundamentally sound. But a persistent pattern of aligned DKIM temperror is worth investigating because it can signal a configuration issue that, if it worsens, could eventually cause real alignment failures.

How to track this pattern over time

The best way to catch aligned DKIM temperror before it becomes a problem is to monitor your DMARC report data continuously rather than reading reports only when something breaks. DMARCFlow parses your aggregate reports from Yahoo and other major receivers, tracking shifts in your DKIM alignment results across reporting periods. If your aligned DKIM temperror rate climbs week over week, that is a signal worth investigating before it becomes an alignment failure.

You do not need to read raw XML to spot this. A monitoring tool that tracks your aligned DKIM result breakdown gives you that signal automatically.

Summary

• dkim=pass and adkim=temperror in the same Yahoo DMARC report are not contradictory; they measure different stages of the verification chain
• temperror means Yahoo could not complete the alignment check, not that your DKIM signature is invalid
• The most common causes are transient DNS lookup failures, DNSSEC validation issues, and selector record propagation delays
• Consistent aligned DKIM temperror is worth investigating as a warning sign of a deeper DNS or configuration issue
• Continuous DMARC monitoring catches this pattern before it becomes a full alignment failure

If you are seeing this combination in your reports and your DKIM setup is otherwise correct, the temperror is most likely a transient DNS artifact. If it persists, start by checking your selector record's DNSSEC status and TTL values.