Is two DKIM signatures an error?

No. It can be a normal result of multiple responsible systems, a mailing list, or a controlled transition.

What happens if one signature passes and one fails?

Receivers evaluate them independently. The failed signature does not automatically erase the passing result, although local filtering can consider the complete pattern.

Which signature does DMARC use?

DMARC can use a passing DKIM signature whose signing domain aligns with the visible From domain. A passing signature from an unrelated provider domain is not enough for DKIM alignment.

Can two services use the same selector?

No. Two services should not share a selector and private key merely for convenience. Separate selectors make ownership, rotation, and revocation clearer.

Should I remove a provider's extra signature?

Not simply because it is extra. First confirm that your aligned signature passes. Provider signatures can supply useful handling evidence even when they do not satisfy your DMARC alignment.

Can an email have multiple DKIM signatures?

Yes. One email can contain multiple DKIM-Signature header fields. The original sender, a mailing list, or an outbound gateway may each add a signature, and a sender can temporarily use two during a transition. Receivers evaluate the signatures independently. For DMARC, the useful signature is one that both passes verification and has a signing domain aligned with the visible From domain. An unrelated passing signature does not cancel a failed one or make DMARC pass by itself.

Quick takeaways

Multiple DKIM signatures on one message are valid protocol behavior.
Each signature has its own signing domain, selector, covered fields, and result.
A receiver should evaluate the signatures independently.
One broken signature does not automatically invalidate another passing signature.
DMARC needs at least one passing DKIM signature whose domain aligns with the visible From domain, unless aligned SPF passes instead.

DMARC can use any passing aligned DKIM signature, shown as a four-step technical sequence.

This diagram summarizes the article's diagnostic sequence. Use the linked standards, current provider documentation, and production evidence for exact decisions. Open the full-size diagram.

Who is affected?

This matters to domains that send through several systems, use an outbound security gateway, participate in mailing lists, or rotate signing methods. It also matters to investigators reading a header that contains two or more DKIM results and trying to decide which one represents the author domain.

Do not confuse multiple signatures on a message with multiple DKIM records in DNS. DNS selectors let services publish separate keys. The DKIM-Signature fields show which of those keys were actually used on this message. Palisade's DKIM overview explains the basic signing flow.

What are the requirements?

RFC 6376 allows signatures from the same or different organizations involved in handling a message. Every signature must be verified using its own d= signing domain and s= selector. The receiver can process them in any order, but should judge each on its own merits.

For DMARC, inspect the result that aligns with the visible From domain. A provider signature such as a platform-owned domain may pass DKIM without aligning to your brand domain. A second signature using your domain can provide the aligned pass. Read the DMARC overview before treating all DKIM passes as equivalent.

When does the requirement take effect?

Multiple-signature behavior is part of DKIM as standardized in RFC 6376. It is not a new provider deadline. The operational requirement applies whenever more than one DKIM-Signature field is present, including during key or infrastructure transitions.

Current DMARC evaluation is defined by RFC 9989. That standard keeps the important distinction between a valid signature and an aligned valid signature.

How do I implement the requirement?

1. Decide which system owns the aligned signature

Choose the sending service or final outbound gateway that can sign with the domain visible to recipients. Give each independent system its own selector and private key.

2. Sign after intentional content changes

If a gateway adds a footer or rewrites links, make that change before the signature that must survive delivery. An earlier signature may remain useful, but a later content change can break it.

3. Keep every selector resolvable

Publish the public key for each active signing domain and selector. A valid record in DNS is not proof that the message used it, so also check a delivered header.

4. Retire old signatures deliberately

Stop adding an obsolete signature only after the new one is visible and passing in production. Keep an old public key available long enough for messages already in transit or deferred verification.

How do I validate compliance?

Open the delivered message source and locate every DKIM-Signature field. Match each d= and s= pair to its authentication result. Confirm that the intended signature passes and that its signing domain aligns with the visible From domain when DKIM is expected to satisfy DMARC.

Use the DNS lookup tool to check each selector, then use Email Security Score for the domain's public configuration. The delivered header remains the evidence that the correct systems actually signed this message.