1

When signing a message with DKIM, the choice of which domain's signature to use seems to lie on the sender - as far as I can tell, there is nothing prescriptive in the DKIM specification which says which certain specific domains must be signed.

So, which domain(s) should the DKIM d field match?

Some of the options:

  • The domain name of the address from the From header
  • The domain name of the envelope From
  • The host name of the mail server, as used in HELO/EHLO / Received headers (when forwarding mail?)
  • The reverse hostname of the sender IP?
  • The domain name of the Sender header (as mentioned in the DKIM RFC)?

Since DKIM allows multiple signatures in a single message, one approach is to go ahead and sign the message for all involved domains for which we have signing keys of.

Are there any definitive rules, though?

Improve this question

1 Answer 1

Reset to default
1

For DMARC alignment, the from header should be signed, if that is not possible then sign the SMTP mail from domain.

DKIM-SSP also indicates the from header should be the domain signed

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .