DKIM failure (identity mismatch) when using MailBaby as smarthost

webdig

Hello,

All the websites hosted on my servers are sending email through the MailBaby smarthost, but I have one client whose domain is showing the following authentication results:

spf=pass smtp.mailfrom=comercial@dominiodomeucliente.pt;
dkim=policy(identity domain mismatch) header.i=@mailbaby.net;
dkim=fail (body hash mismatch) header.i=@mailbaby.net;

The client is asking if it’s possible to “have the same patch/return-path”, meaning that SPF, DKIM and DMARC should all align with the domain dominiodomeucliente.pt.

From what I can see:

SPF is passing correctly and aligned.

DKIM is failing because MailBaby signs with mailbaby.net instead of the client’s domain, and there is also a body hash mismatch error.

My questions are:

Can Enhance be configured to sign outgoing mail with the client’s DKIM key before relaying through MailBaby?
Or is it necessary to configure a custom DKIM key directly in MailBaby so that the relay signs with dominiodomeucliente.pt instead of mailbaby.net?
I believe it’s not possible to disable the smarthost just for one specific client. Would it be better to disable the smarthost for all clients?

I would appreciate any guidance from others already using MailBaby with Enhance.

Thank you!

Nickske00

Is dkim signing turned on for the domain in enhance? I did a quick test (via mail-tester) and can see both dkim signatures in the headers (my own and those from mailbaby). Both also get validated by mail-tester...

SharedGrid

If you have DKIM turned on within the control panel, and the records exist then the email will be DKIM signed before leaving your mail server to mailbaby. Once mailbaby forwards the email then it will also be signed by mailbaby, for example I just sent a test email and this is my DKIM result:

   dkim=pass header.i=@mailbaby.net header.s=bambino;
   dkim=pass header.i=@sharedgrid.com header.s=hostingcp;

From what you've posted the DKIM toggle isn't on within Enhance or the records don't exist?

webdig

Thank you for the replies.

I already had DKIM enabled in Enhance and the DNS record was configured (showing as “valid” in the panel). However, in the data that was forwarded to me by the client, only the mailbaby.net signature appeared, which caused the alignment failure.

Now, in new tests (mail-tester), both DKIM signatures are showing as valid:

dominiodomeucliente.pt (which ensures DMARC alignment),
and mailbaby.net (which the relay adds by default).

So the situation is resolved — mailbaby.net still appears, but that is normal and does not affect alignment or deliverability.

In this particular case, it involves a somewhat “problematic” client who has recurring issues with their own computer software. I’ve pointed this out several times, but the client always assumes the issues come from outside. They are also an ex-customer of AMEN and, according to them, “everything always worked perfectly there.”

Thanks for the help!