Direct answer
DKIM lets a signing domain attach a cryptographic signature to selected message content, which a receiver can verify using a published key. A valid signature does not establish that the sender's business request is legitimate or that the account was not compromised.
Identify the signing domain
An authorized mail administrator can review the original message and trusted receiver results to see which domain signed it. Do not assume the signing domain and the user-visible From domain are the same; alignment is a separate question.
Reference: RFC 6376: DomainKeys Identified Mail Signatures.
Connect keys to owners
Organizations may use different selectors and keys for different mail services. Record the service owner and expected signing arrangement before rotating or removing a key. Public DNS key availability alone does not prove that every legitimate sending path is signing correctly.
Reference: RFC 6376: DomainKeys Identified Mail Signatures.
Test an approved change
Coordinate a key or provider change with mail operations. Send controlled messages through each affected service to test recipients and check trusted receiver authentication results. Keep a rollback path and investigate unexpected failures before retiring the old arrangement.
- Record signing domain, selector and test time.
- Include representative transactional and user mail.
- Avoid publishing private signing keys or raw sensitive message content.
Avoid overclaiming
A signed message can still contain a fraudulent payment request if a legitimate account was compromised. Independently verify consequential changes. A failed signature can have operational causes and should be evaluated with the complete delivery path.
Assessment limits
DKIM verifies a particular signature and selected content, not the truth of a message. Interpretation depends on trusted receiving results, message transformations and key configuration.
Frequently asked questions
Does a valid DKIM signature prove a message is trustworthy?
No. It verifies a signature under the relevant key; the request and account context still need independent review.
Does an unsigned message prove phishing?
No. Legitimate sending paths can be misconfigured or unsigned. Investigate with the mail owner and other evidence.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.