How To: Read a DKIM Signature

In short. DKIM (DomainKeys Identified Mail) attaches a cryptographic signature. If it verifies, the signing domain (d=) vouches that selected headers and the body were not altered in transit.

What the signature covers

A genuine message includes a DKIM-Signature header. Useful tags:

• d= — the domain that signed.
• s= — the selector (which DNS key to fetch).
• h= — which headers were signed (often From, To, Subject, Date).
• bh= — a hash of the body.

Results in Authentication-Results:

• dkim=pass — the signature matched.
• dkim=fail — it did not (altered, or never signed correctly).
• dkim=none — no usable signature.

Pass does not mean “this is the brand”

DKIM proves the signing domain stood behind those bytes. A phish can be validly signed by the attacker’s own domain. Compare d= with the visible From — that is why DMARC alignment exists.

A missing signature on bank or IT mail is a warning, not proof on its own. Some legitimate mail is unsigned.

In the simulator

• Genuine statement: DKIM-Signature with d=meridianbank.example and dkim=pass header.d=meridianbank.example.
• Spoofed “verify” copy: dkim=fail header.d=mer1dian-alerts.example — not the From domain.