What it means
DKIM lets a signing domain take responsibility for selected parts of a message. The sender adds a signature. The receiver retrieves the public key from DNS, under the selector the signature names, and checks that the signed headers and body still match. A valid signature associates that signing domain with the signed content. It does not prove that the display name is honest or that a particular person composed the text.
RFC 6376 is Internet Standard STD 76, September 2011. It obsoletes RFC 4871 and RFC 5672. The signature’s domain can differ from the domain in the visible From. When they differ, keep both names in the note. A stolen sending key or a compromised mailbox can produce a signature that verifies. Verification is a cryptographic association, not a judgment of the request inside the message.
AN ILLUSTRATIVE SCENARIO
A signature on a Harbor Mail notice
Harbor Mail signs customer notices with a key published for harbor.example. Maya records the signing domain and that the signature verified. The display name still says “Harbor Finance,” which is a label in the header, not the signing domain. She does not tell Sam the signature proves a clerk typed the wire instructions.
Put it to work
- Identify the signing domain and selector on a message you are allowed to inspect, then confirm the public key is the one that domain publishes in DNS.
- Note which content the signature covers and whether verification succeeded. Keep the visible From domain as a separate field.
- If you operate the domain, rotate keys on a plan and remove selectors you no longer use. A forgotten selector is still a key.
How to check your work
On a synthetic signed message, write the signing domain, whether verification succeeded, and one claim the signature does not make about the person or the display name.
Connect the ideas
- DNS
The lookup system that maps a name people type to an address a computer can contact.
- SPF
A DNS policy that says which hosts may use a domain in the MAIL FROM or HELO identity. A pass authorizes that host for that identity. It does not prove the visible From address or a person’s intent.
- DMARC
A DNS policy that checks whether the visible From domain aligns with a domain SPF or DKIM authenticated, and that publishes a handling preference plus reporting. A pass is authorized use of that domain, not a safety verdict.