Does a DKIM-Signature header mean the message passed DKIM?

No. The header only shows that a signature is present. A receiver must fetch the public key and verify it, and the Authentication-Results header records the outcome.

What do d= and s= mean?

d= is the signing domain and s= is the selector used to find the public key in DNS, at selector._domainkey.domain.

Why would DKIM fail on a legitimate message?

Changes after signing, such as a mailing list adding a footer or a gateway rewriting content, change the hash the signature covers.

Security

Published October 9, 20263 min read

What Does DKIM PASS Mean?

What a verified DKIM signature proves, how to read the tags, and what it cannot tell you.

DKIM PASS means a receiving server verified a cryptographic signature that a domain added to the message. It is a stronger statement than SPF about the message itself, but it still has limits.

What a DKIM signature looks like

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com;
        s=mail2026; t=1791442800; h=from:to:subject:date:message-id;
        bh=Zm9vYmFy...; b=AbCdEf...

Tag	Meaning
d=	Signing domain
s=	Selector for the DNS key
a=	Algorithm (rsa-sha256 or ed25519-sha256 are current choices)
c=	Canonicalization of headers and body
h=	Headers covered by the signature (From must be included)
bh=	Hash of the body
b=	The signature itself
t= / x=	Signing time and optional expiration

What a pass proves

A pass means the signed headers and body hash matched when the receiver checked them, so those parts were not altered after signing, and the signature was made with a key published by the signing domain. It does not say the content is trustworthy.

What it does not prove

The signing domain may differ from the From domain, so a pass does not tie the message to the visible sender unless it aligns.
A malicious sender can sign with a domain they own.
Parts not covered by h= can change without breaking the signature.

Detected is not verified

The Email Header Analyzer reports DKIM signature detected; cryptographic verification was not performed. It lists the tags and shows the pass or fail that a receiving server reported, but it does not fetch DNS keys or verify signatures. Treat the Authentication-Results from your own provider as the verification.

DKIM and DMARC

DMARC counts a DKIM pass only if the d= domain aligns with the From domain. That is why third-party sending services ask you to publish a DKIM key for your own domain. See SPF vs DKIM vs DMARC Explained.

Share headers safely

Headers contain addresses, IP addresses and server names. If you need to paste them into a ticket or chat, mask the sensitive values first with the Log Sanitizer, and only analyze messages you are authorized to inspect.

Frequently asked questions

Does a DKIM-Signature header mean the message passed DKIM?: No. The header only shows that a signature is present. A receiver must fetch the public key and verify it, and the Authentication-Results header records the outcome.
What do d= and s= mean?: d= is the signing domain and s= is the selector used to find the public key in DNS, at selector._domainkey.domain.
Why would DKIM fail on a legitimate message?: Changes after signing, such as a mailing list adding a footer or a gateway rewriting content, change the hash the signature covers.

#email #dkim #email-authentication #email-headers