What domain name should appear in a DKIM signature

dkimpostfix

I followed these instructions to setup OpenDKIM with Postfix, and it works as advertised. My outgoing mails have the DKIM-Signature header added, for example:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=example.com; s=mail;
t=1398638300; bh=mk/7yYUxFCWz+ZHB0opJIA/S3J5ELoPZPfAO0KQdVg4=;
h=Date:From:To:Subject:From;
b=fPPfUliJUgA0re38nkJ2R18TeFgbamOv1U8nDb9958eTeAT6Mp7oq4WGrHPiPmc+b
mrLu9RuW0/S4d0ipkilNZDxgecwl7qttrDbTEkWxdhwwTSe5FL3OBaUoUxJFrMGjmY
RdBjY5ZWtvk29+gXZ+af5Of9OrY7COLlqGkFXRXw=

My question is about the d= parameter above. In cases where one mailserver handles the outgoing mail of multiple virtual domains, should the d= contain the mailserver sending the message? Or should it be the domain that appears in the From: address?

I have tried to read RFC 6376 about this subject, but the only relevant bit I found was:

  d= The SDID claiming responsibility for an introduction of a message
  into the mail stream [...]  The conventions and semantics used by a Signer to
  create and use a specific SDID are outside the scope of this specification

I'm hoping someone here knows how the d= parameter is used in practice.

Best Answer

A DKIM signature from the sender's domain is most reliable, and may be required by the sender's email policies. With the introduction of DMARC it is now possible for domains to publish a policy with desired actions for email which does not meet the policy.

DKIM is intended to match the sender from the header, which may not be the envelope sender. SPF validates the permission of the envelope sender to send mail for the domain using the sending server. DMARC ties the two together, to provide a better policy framework.

All three mechanisms require data to be published in the DNS tree of the domain involved.

DKIM from a third party merely indicates whether or not the signed content has been modified after signing by that domains. This may be useful for repudiation, but not for sender reputation.

Related Topic