DKIM passes, but your subject is not signed

Find the signed headers

Open the original email source and find DKIM-Signature. The h= tag lists the headers included in that signature. This simplified example covers From, To and Date, but not Subject.

h=from:to:date;

Why this matters

If Subject is not covered by any valid signature, that signature does not protect the subject from changes. This is a protection gap, not proof that the email is spam or that someone changed it. Inspect every signature when a message has more than one.

Two separate questions

First, did this signature verify? Second, does its h= list cover Subject? A list alone cannot prove a valid signature. These simplified lists illustrate what to inspect; they are not complete signatures.

Verified signature A: h=from:to:date;
  Subject: not protected by A
Verified signature B: h=from:to:date:subject;
  Subject: protected by B
No verified signature: protection not established

Fix the signer, not the subject

Ask your sending provider to include Subject and other important headers in its DKIM signing configuration. Editing the h= list in an already-signed email invalidates the signature; the message must be signed again by the provider.

Check the next test

Send another message through the real sending service. SpamBite shows each signature's verified status and signed-header list, including whether a verified aligned signature protects Subject.