DKIM failing when sending to vendor with IronPort, not anyone else

[iscs-mark]

Trying to do what I can from my side, but don't think there is much. We are on O365 and have DKIM configured and signing on our emails. We have one vendor that (I believe) is on IronPort (based on the mx1.xxxx.iphmx.com MX record) and when we send to them, it shows the DKIM as failing. When we send to anyone else, DKIM shows pass in the headers. Done a few DKIM online tests and they all show pass.

Is there something I can mention to their team about this?

[Ken Stieers]

If they're willing, have them login to the CLI on one of their appliances and run
DIG yourdomain.com TXT
DIG -t yourdomain.com TXT
DIG -t yourdomain.com @8.8.8.8 TXT


That should pull all of your TXT records, including the DKIM... make sure they're seeing it in all three.
If they aren't, it could be cache, could be replication, could be UDP limits.

[iscs-mark]

Guessing they are not willing. I got the brush-off reply: This could be affecting a subset of the sending servers or perhaps a platform used that leverages email but the IP I provided and the DKIM error

Guessing there is not a fundamental understanding of DKIM.