Inventory signatures without ranking by position

Create one row for every DKIM-Signature field. Record d=, s=, a=, c=, h=, optional identity and expiry fields, and the corresponding receiver result. RFC 6376 does not assign meaning to signature order; intermediaries can add or reorder fields.

An illustrative message might have a provider signature using d=provider.example and a brand signature using d=example.com. Either, both, or neither may verify. A passing provider signature authenticates that signing domain; it does not automatically authenticate the visible brand domain.

Connect the right signature to DMARC

DMARC considers a DKIM path only when a signature passes and its d= domain aligns with the RFC 5322 From domain under the published alignment mode. A failing aligned signature does not erase a different passing aligned signature. A passing unaligned signature can still be operationally useful but does not satisfy DKIM alignment for that From domain.

Write a table:

Signing domain Selector DKIM result Aligned with From? Role
provider.example p1 pass no Provider infrastructure
example.com brand1 pass yes Brand-aligned signature

These values are illustrative.

Diagnose each failure independently

Use each signature’s own selector and domain for DNS lookup. Check its body hash and signed headers separately. A gateway may add a second signature after modifying content, leaving an earlier one invalid and the later one valid. Do not delete a useful passing signature simply to make a dashboard show fewer rows.

Decide what the sender intends

Document which signature owns DMARC alignment, which supports provider operations, and which systems can modify mail after each signing step. Ensure the intended aligned signature covers the From field as required by DKIM and survives the complete path.

Send a fresh message after any configuration change and inspect the trusted receiver’s result for every signature. The review is complete when each signature has an identified owner and purpose, and the DMARC conclusion cites a specific passing aligned domain—not when the message merely contains the letters “DKIM.”