What is DKIM Alignment?
DKIM alignment is the process of verifying the authenticity of the domain sending the email by using two signatures found in the message where the sender's domain is present.
DKIM allows parts of an email message to be cryptographically signed, and the signature must cover the From field. Within the DKIM-Signature mail header, the d= (domain) and s= (selector) tags specify where in DNS to retrieve the public key for the signature.
A valid signature proves that the signer is a domain owner and that the From field hasn’t been modified since the signature was applied. There may be several DKIM signatures on an email message; DMARC requires one valid signature where the domain in the d= tag aligns with the sender’s domain stated in the From header field.
Example:
An email is sent with a From address of abc@example.com. There are two DKIM keys associated with the email. One authenticated signing domain is mail.dmzv.com. and the other is example.com. This email is considered to be DKIM-aligned.
An email is sent with a From address of abc@example.com. There are two DKIM keys associated with the email. One authenticated signing domain is mail.dmzv.com. and the other is badexample.com. This email is not considered to be DKIM-aligned.