DKIM (DomainKeys Identified Mail) is an email authentication method which makes sure your messages aren’t altered during the transaction between the sending and recipient servers. Typically, DKIM provides a key and signature that makes a user identify that the email received by them is not fake or altered.
DKIM results and DKIM are dependent on the DKIM records and policies (relaxed or strict) you have configured. In the sources section you will see that there are two DKIMs column, here is a breakdown on what these two columns mean:
DKIM domain: This column is the domain specified in your mail header as the return path header, envelope address or bounce address. This is the domain at the backend (of a 3rd party tool, etc) being used to send email from your from domain.
From domain: This is the sending email address the recipient will receive email from. It will appear as the from domain in the email header.
DKIM results: This column checks if your DKIM domain is authorized to use the particular source to send emails or not. It will display pass if the public DKIM key at the receiver’s end matches the public key published at the From domain’s DNS.
DKIM: This column will pass if your From domain and DKIM domain are aligned, and if they abide by the set DKIM policy. If the return path is set then your From and DKIM domain will match, and we say DKIM is aligned. Next it checks if they follow the below DKIM policy:
Relaxed policy (alignment):
In this policy DKIM domain and From domain must be an exact match or a parent/child match. This policy allows a subdomain to be used and still meet the domain alignment requirement.
Strict policy (alignment):
In this policy DKIM domain and From domain must be an exact match for the DKIM to pass.