Does successful DKIM prove the named sender wrote it?¶

title: Does successful DKIM prove the named sender wrote it? subtitle: A valid DKIM signature links signed message content to a signing domain. It doesn’t identify the human author. slug: does-successful-dkim-prove-the-named-sender-wrote-it series: email-evidence section: evidential-limits-and-corroboration card_type: question_card pathway_order: 35 section_order: 1 status: draft public_safe: true video_ready: true word_count: 552 estimated_read_time_seconds: 228 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - email evidence - DKIM - authorship - domain authentication - evidential limits sources: - title: 'RFC 6376: DomainKeys Identified Mail (DKIM) Signatures' url: https://www.rfc-editor.org/info/rfc6376/ - title: 'RFC 8601: Message Header Field for Indicating Message Authentication Status' url: https://www.rfc-editor.org/info/rfc8601/ - title: 'RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)' url: https://www.rfc-editor.org/info/rfc9989/

Does successful DKIM prove the named sender wrote it?¶

A valid DKIM signature links signed message content to a signing domain. It doesn’t identify the human author.

Script¶

You’ve checked the header and found that DKIM passed.

That is useful evidence.

It still doesn’t prove that the person named in the From field wrote the email.

DKIM applies a cryptographic signature using a key associated with a domain. The signature covers the message body and selected header fields chosen by the signing system.

When the signature validates, it supports two important conclusions.

The signing domain controlled the private key used to create the signature.

And the signed material hasn’t changed in a way that breaks the signature since it was signed.

That can help show that the message followed a genuine provider, organisation or platform route.

It can also help distinguish a preserved message from a copy whose signed content was altered later.

But DKIM is deliberately a domain-level mechanism.

The signing domain may be the sender’s employer, email provider, customer-management system, marketing platform or another authorised service.

It may sign millions of messages for many users.

The signature doesn’t normally record which person composed the words.

It may not even identify the individual mailbox that triggered the message.

Look at the DKIM d= value to identify the signing domain.

Check the s= selector to identify the key record used.

Review which header fields appear in the h= list and were therefore included in the signature.

Look at any i= identity value, but don’t assume that it identifies a human user. DKIM allows the signer to commit only to a domain rather than an individual address.

Also check who reported the pass.

Use an Authentication-Results field added by the recipient’s provider or another trusted receiving system. A sender can insert a fake-looking result before the message reaches that trust boundary.

Then ask how the signing domain relates to the visible From address.

A DMARC pass may show that the DKIM signing domain aligned with the From domain.

That strengthens the conclusion that the visible domain authorised or accepted the sending arrangement.

It still doesn’t prove that the named employee, customer or account holder wrote the message.

Several realistic explanations remain.

The account may be shared.

A delegate may have sent it.

A CRM or workflow may have generated it.

A connected application may have used an authorised token.

A marketing platform may have assembled it from a template.

Or the real account may have been compromised.

All of those can produce a valid DKIM signature because the genuine sending service signed the message.

The common mistake is:

“DKIM passed, so this is definitely from Steve.”

The safer conclusion is:

“The message contained a valid DKIM signature made by this domain, covering these parts of the message.”

If DMARC also passed, you may add:

“The authenticated signing domain aligned with the domain displayed in From.”

Those are strong and useful technical findings.

The next step is account attribution.

Which customer, mailbox, campaign, user, session or application caused the signing service to create and send this particular message?

Provider message trace, account audit, application records, session identifiers and device evidence may answer that question.

Then comes authorship.

Who composed, approved or triggered the content?

That may require drafts, local files, surrounding communications, exclusive knowledge, witness evidence or other corroboration.

Successful DKIM tells you something important about the domain and integrity of the signed material.

It doesn’t identify the person behind the keyboard.

DKIM can support domain and message-integrity conclusions. It doesn’t turn the From name into a proven person.

Related questions¶

• What do SPF, DKIM and DMARC actually prove?
• Can an email identify the person who wrote it?
• What if the sender’s account was compromised?
• What if the message came through a mailing platform or customer-management system?

Source notes¶

• RFC 6376: DomainKeys Identified Mail (DKIM) Signatures
• RFC 8601: Message Header Field for Indicating Message Authentication Status
• RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)