A signature belongs to a signing domain
DKIM uses a cryptographic signature to associate a message with a signing domain. A receiver retrieves the corresponding public key from DNS and verifies the signature. The d= value identifies the signing domain; s= identifies the selector used to locate its key.
A message can carry more than one DKIM signature. The presence of a DKIM-Signature header is not itself evidence that verification passed.
Use the reported result and identity together
In CheckDMARC, compare the DKIM result, signing domain and visible From domain. Paste headers interprets recorded authentication results; it does not independently re-run cryptographic verification. A green result is meaningful only in the context of a receiver you trust.
| Field | Why it helps |
|---|---|
| DKIM result | Distinguishes a reported pass from fail, missing or an error. |
| Signing domain (d=) | Shows whose domain signed and lets you investigate alignment. |
| Selector (s=) | Helps your provider find the matching DNS key configuration. |
| Original receiver headers | Preserves the context of the verification result. |
Check the sending service before replacing keys
For a missing signature, confirm that custom-domain signing is enabled in the service that sent this message. For a failure, check that the selector and DNS key match the provider’s current setup. Message modifications in transit can also invalidate a signature.
Test each sender separately. A passing signature from your mailbox says nothing about a newsletter sent by another platform. Avoid replacing or deleting active keys without checking which systems still use them.
Sources
Sources checked on 6 November 2026. Provider guidance can change.