Home / server / Questions / 895464
In Process
Vladimir Panteleev
Asked: 2018-02-03 16:19:53 +0800 CST

Which domain to sign with DKIM?

  • 772

When signing a message with DKIM, the choice of which domain's signature to use seems to lie on the sender - as far as I can tell, there is nothing prescriptive in the DKIM specification which says which certain specific domains must be signed.

So, which domain(s) should the DKIM d field match?

Some of the options:

  • The domain name of the address from the From header
  • The domain name of the envelope From
  • The host name of the mail server, as used in HELO/EHLO / Received headers (when forwarding mail?)
  • The reverse hostname of the sender IP?
  • The domain name of the Sender header (as mentioned in the DKIM RFC)?

Since DKIM allows multiple signatures in a single message, one approach is to go ahead and sign the message for all involved domains for which we have signing keys of.

Are there any definitive rules, though?

email

1 Answers

  1. For DMARC alignment, the from header should be signed, if that is not possible then sign the SMTP mail from domain.

    DKIM-SSP also indicates the from header should be the domain signed

    • 1