DKIM itself does not in fact have any link between the signing domain and the RFC5322.From address, nor any address listed in any of the mail headers. For proof of this, see for example section 4.1 of RFC 5585 as well as this blog post from FastMail where they mention they have been using their own domain to sign outgoing mail for their customers' domains.
Essentially, DKIM ties a reputation to the signing domain, which is a very important distinction to make.
Someone could sign spam that is forged to look like it's from example.com
with his own domain of spammer.com
, but the idea is that spammer.com
would quickly have a bad reputation then. A good domain on the other hand that does not send spam would get a good reputation so that you could assign a higher level of trust to mail signed by this domain.
That said, in my own experience, I have only ever seen Microsoft/Hotmail diverting from the RFC here by interpreting a valid DKIM signature signed by another domain with a result of dkim=none
. rather than with a dkim=pass
which it should have been. So to fully answer the question, it should not, but in practice, it still may.
On a side-note, Author Domain Signing Practices (ADSP - sorry, I lack the reputation to link it) did set up a link between the signing domain and the author address, but it never gained widespread adoption and has been demoted to historic
now.
Also, the upcoming DMARC (Domain-based Message Authentication, Reporting & Conformance) specification introduces the concept of "aligned identifiers" which also requires a DKIM signature of the same domain as that used in the RFC5322.From address.