Email glossary · Practical guide
DKIM: signed message evidence and the signing domain
DKIM uses a domain-associated signature to let a receiver verify signed message content. The signing domain matters when comparing the signature with the visible From domain.
Reviewed · Examples are illustrative
Who this helps: Readers checking a term before making an outreach or mailbox decision.
Meaning and common confusion
A signature can pass for a service domain that differs from the sender identity shown to the reader. Conversely, a missing key or changed signed content can prevent verification. A DKIM result does not establish that every claim in the body is true or that the recipient requested the message.
Source: RFC 6376: DKIM signatures
Worked example
This is a synthetic illustration, not a customer result or a live configuration to copy.
DKIM-Signature fields: d=brand.example; s=mail2026
Lookup name: mail2026._domainkey.brand.example
Review: signature result, signing domain and selector together
Do not infer business legitimacy from pass alone.Checks to make
- Inspect the actual delivered signature fields.
- Confirm the selector record belongs to the intended service.
- Compare a controlled message before and after signing changes.
Next step and limits
Use selector troubleshooting when the key cannot be found, and body-hash troubleshooting when content modification is suspected. Keep private signing keys out of public DNS and support screenshots; DNS contains the public verification material.
Source: RFC 6376: DKIM signatures
Source references
Worked examples are illustrative. Editorial procedures are suggested methods, not measured performance claims or promises of additional product features.
Related guides
- DKIM selector not found: query the name in the actual signature →
- DKIM body hash mismatch: locate the message modification →