diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5bd95e37e..01ccb2e26 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -37,6 +37,7 @@
 ### Fixes
 - `dc_search_msgs()` returns unaccepted requests #3694
 - emit "contacts changed" event when the contact is no longer "seen recently" #3703
+- do not allow peerstate reset if DKIM check failed #3731
 
 
 ## 1.98.0
diff --git a/src/mimeparser.rs b/src/mimeparser.rs
index 10696e617..c87c627e2 100644
--- a/src/mimeparser.rs
+++ b/src/mimeparser.rs
@@ -298,6 +298,7 @@ impl MimeMessage {
                     if let Some(peerstate) = &mut decryption_info.peerstate {
                         if message_time > peerstate.last_seen_autocrypt
                             && mail.ctype.mimetype != "multipart/report"
+                            && decryption_info.dkim_results.allow_keychange
                         {
                             peerstate.degrade_encryption(message_time);
                             peerstate.save_to_db(&context.sql, false).await?;