DMARC DKIM Pass with Temp Error Explained

When you look at a DMARC aggregate report and see DKIM listed as pass in the policy_evaluated section while the auth_results section shows your aligned DKIM signature with a temperror, it looks like a contradiction. Your mail either passed or failed -- it cannot do both at the same time.

The confusion comes from reading the two sections as if they describe the same thing. They do not.

What the two sections actually measure

A DMARC aggregate report has two main sections that people read together and find contradictory:

**auth_results** tells you what the receiver's DKIM validator concluded about each signature it checked. A result of "temperror" means the signature could not be validated at that moment -- usually because a DNS lookup timed out, a key could not be retrieved, or a cryptographic operation failed. It is not a statement about whether your DKIM configuration is correct.

**policy_evaluated** tells you what the receiver's DMARC module concluded after combining SPF, DKIM, and alignment checking. "Pass" here means the message satisfied the DMARC alignment check -- not that every signature was fully verified.

The receiver runs DKIM validation and then applies its own rules when deciding what counts toward the DMARC pass or fail result.

When you use a DMARC report analyzer like DMARCFlow, both sections are displayed together with clear labels. Without that, you have to read raw XML and cross-reference the source IP and message ID from policy_evaluated against the auth_results entries to understand which signature the receiver actually used for its decision. Most people skip this step, which means the temperror in auth_results goes unnoticed even when it affected a meaningful share of traffic.

Why a DKIM temperror does not always block DMARC pass

RFC 7489 describes how receivers handle authentication failures. A DKIM temperror is a temporary condition, not a definitive failure. The RFC leaves room for receiver discretion: a receiver may retry, may treat the result as inconclusive rather than failing, or may weigh other authentication signals to reach a decision.

This matters for DMARC alignment. DMARC requires at least one of SPF or DKIM to pass AND align with the From domain. When your aligned DKIM signature returns temperror, the receiver has two paths to a DMARC pass:

1. **SPF aligned and passing.** If the message arrived from an IP covered by your SPF record and the SPF result aligns with your From domain, SPF alone can satisfy DMARC -- DKIM does not need to pass if SPF passes alignment.

2. **Other DKIM signatures on the message.** If the message was signed by a third party (such as a mailing list, forwarding service, or security gateway) and that non-aligned signature passes DKIM checking, the receiver may use that as an additional signal -- though alone it does not satisfy DMARC alignment because it is not your domain.

The key point: a non-aligned DKIM pass does not satisfy DMARC alignment on its own, but it can influence how the receiver weighs an inconclusive or failing aligned DKIM result.

What a DKIM temperror actually means

"Temperror" in DKIM terms (defined in RFC 6376) means one of these occurred during signature verification:

The DNS query to retrieve your DKIM public key timed out or returned SERVFAIL.
The email passed through a filter or processing step that modified the message body or headers after signing, which breaks the DKIM signature.
A cryptographic operation during signature verification returned an error rather than a definitive result.
The receiver's validator hit an internal transient error.

None of these indicate your DKIM key is wrong or your DNS records are misconfigured. They indicate the receiver could not complete verification at that moment.

The alignment problem in plain terms

Your aligned DKIM signature is the one signed using a selector under your own domain's control. When that signature produces a temperror, it means the receiver could not validate it -- not that it is invalid.

But DMARC only cares about aligned results. A passing, non-aligned DKIM signature from a third party on the same message does not help your DMARC alignment check. The receiver still needs either aligned SPF or aligned DKIM to pass.

If your aligned DKIM is showing temperror and SPF is also failing or not aligned, the DMARC pass you see in policy_evaluated may come from a retry attempt that succeeded, from a receiver-specific rule that gives weight to an inconclusive result, or from the receiver applying a lenient policy when other signals suggest the message is legitimate. This is where different email receivers can show different results for the same message.

What you should do when you see this pattern

1. **Confirm your DKIM DNS resolves reliably.** Query your DKIM selector directly with a DNS lookup tool and measure response time. If your DNS provider has latency above 1-2 seconds for DKIM queries, some receivers may time out and return temperror.

2. **Read the full auth_results section.** Do not stop at the first DKIM result. There may be multiple DKIM signatures on the message -- some from your domain, some from third parties. The one showing temperror may not be the one the receiver ultimately used for alignment evaluation. DMARCFlow parses the full auth_results breakdown and shows you which signature was used for alignment alongside the policy_evaluated result, making it easy to spot when your aligned signature is the one producing temperror.

3. **Check whether this is isolated to one receiver or widespread.** A temperror from Yahoo or Gmail occasionally is not alarming. Consistent temperror from multiple major receivers suggests your DKIM DNS resolution is slow or your signing infrastructure is producing timing-dependent failures.

4. **Look at the failure rate.** If temperror appears on less than 1% of your volume from a given receiver, it is probably their infrastructure. If it is consistently above 5%, something in your DNS or DKIM setup is causing repeated validation problems for that receiver.

5. **Use a DMARC report analyzer that surfaces this automatically.** When policy_evaluated shows pass but your aligned DKIM shows temperror, you need to see both at the same time to know whether to investigate or ignore. DMARCFlow highlights this exact contradiction without requiring you to parse raw XML.

Why this is harder to spot without a good report parser

Most DMARC report tools summarize policy_evaluated and drop the detailed auth_results breakdown. You may see a DKIM pass in the summary and never notice that your aligned signature returned temperror on 10% of your traffic to a specific receiver.

This matters because temperror is a fixable problem -- usually your DNS latency or a flaky signing service. But you can only fix it if you know it is happening. A tool that surfaces both fields side by side makes the pattern visible without manual XML archaeology.

FAQ

What does DKIM temperror mean in a DMARC report?

It means the receiver could not complete DKIM signature verification at that moment. The most common causes are temporary DNS lookup failures, transient validator errors, or message modification in transit that broke the signature after signing. It is not a permanent failure of your DKIM configuration.

Why does policy_evaluated show DKIM pass when my aligned DKIM has temperror?

The receiver has discretion over how to handle DKIM temperror under RFC 7489. It may treat it as inconclusive rather than as a fail. If your message also has a passing, aligned SPF result, the DMARC check can pass through SPF alignment alone -- DKIM does not need to pass if SPF passes and aligns. Or the receiver may have retried the DKIM check and succeeded on a second attempt, recording the first temperror while still reaching a pass.

Is my email actually passing DMARC if the aligned DKIM shows temperror?

It depends on what other signals were present and how the receiver handled the inconclusive result. If aligned SPF passed, the message can satisfy DMARC through SPF alignment regardless of DKIM status. Check whether your SPF is aligned and passing for the same messages showing DKIM temperror. If SPF is also failing or not aligned, the DMARC pass from an inconclusive DKIM temperror may not be reliable.

What should I do when I see this in my DMARC reports?

First, verify your DKIM DNS records resolve quickly and reliably. Second, check whether the pattern is isolated to one receiver or appears across multiple receivers. Third, use a DMARC analyzer that shows you both auth_results and policy_evaluated together so you can determine whether your aligned DKIM is producing the temperror and whether your SPF is compensating. DMARCFlow shows this contradiction automatically and flags when your aligned signature is the one returning temperror.

---

*DMARCFlow helps you parse DMARC aggregate reports and surface contradictions like DKIM temperror versus policy_evaluated pass before they become deliverability problems.*