receiving mail server
Message
Signature · DKIM-Signature
v=1;
a=rsa-sha256;
d=chronos.orbital;
s=orb2026;
bh=…;
b=…
Signing domain · d=
chronos.orbital
Selector · s=
orb2026
Visible from
ceo@chronos.orbital
not the identity check · signed, not matched to d=
Signature
present · d=chronos.orbital
DNS · Public key TXT
Key at orb2026._domainkey.chronos.orbital
v=DKIM1;
p=…
Body hash ↔ bh=
Body hash (computed)
…
vs
bh= (claimed)
…
Compare computed Body hash to the Signature bh= claim
Signature → DNS key → Hash → Verify
A pass is not safe. A domain is not a person.
DKIM Pass proves signature integrity for the Signing domain claim.
It does not prove author identity or payload safety.
Signing domain claim does not identify the Visible from sender
Mnemonic: Signature → DNS key → Hash → Verify