What an Incorrect DKIM d= Parameter Can Reveal
An email can appear to come from a familiar Australian organisation while its cryptographic signature tells a different story. The DKIM d= parameter identifies the domain that signed the message, so it is a useful clue when investigating suspicious mail.
A mismatch does not automatically prove fraud. Businesses often send mail through marketing platforms, help desks, payment providers and cloud services. However, when the signing domain has no credible relationship with the visible sender, the message deserves closer inspection.
This matters in Australia, where phishing campaigns commonly imitate banks, myGov, the Australian Taxation Office, Australia Post and major retailers. A convincing logo and local language cannot compensate for broken email authentication.
A sender reputation check can put the technical evidence into context. Trusted Sender Score provides domain trust checks and tools for examining DKIM, DMARC and spoofing risks before a recipient acts on a message.
How The DKIM d= Field Works
DKIM adds a digital signature to selected email headers and the body. The receiving mail server looks up a public key in DNS, then checks whether the signature matches. Within that signature, d= names the domain responsible for signing, while s= identifies the selector used to locate the key.
For example, a message that visibly claims to come from alerts@securebank.com.au might contain d=mailer-example.net. That does not establish that mailer-example.net is malicious, but it shows that another domain signed the message. The relationship between the visible From domain and the signing domain is therefore important.
When A Mismatch Becomes Suspicious
A different d= value can be legitimate when a company uses an external email delivery service. Many Australian businesses send newsletters, receipts and appointment notices through specialised providers. Those providers may sign with a delegated subdomain such as mail.company.com.au, which can still align with the organisation’s domain under DMARC rules.
The risk rises when the signing domain is newly registered, unrelated to the brand, poorly configured or associated with disposable infrastructure. A message pretending to be from an Australian bank but signed by an unrelated overseas domain is a stronger phishing indicator, especially if it requests a password, one-time code or urgent payment.
What The Header Can Reveal
Inspect the complete message headers rather than relying on the sender name shown in Outlook, Gmail or a mobile mail app. Compare the From, Return-Path, Reply-To, d=, SPF result and DMARC result. A suspicious message may display a trusted brand in the interface while routing replies to an unrelated mailbox.
Look for authentication results such as dkim=pass, spf=pass and dmarc=fail. A DKIM pass only means the signature is valid for the signing domain; it does not mean the visible sender is genuine. If the d= domain is unrelated to the From domain and DMARC fails, impersonation becomes a credible explanation.
Why DMARC Alignment Matters
DMARC evaluates whether the authenticated domain aligns with the domain in the visible From address. In relaxed alignment, a related organisational domain may qualify; in strict alignment, the domains must match more closely. This distinction explains why a legitimate subdomain can pass while an unrelated provider domain fails.
Forwarding and mailing-list changes can also affect authentication. A signature may break when message content is altered, while ARC headers may preserve information about earlier authentication decisions. Investigators should therefore assess the complete authentication chain rather than treating one failed result as conclusive.
Practical Checks For Australian Teams
For a suspected invoice, parcel notification or tax message, avoid using embedded links. Visit the organisation through a known bookmark or type its address manually. Australia Post delivery scams and fake myGov or ATO notices often rely on urgency, unusual payment requests and lookalike domains.
Security teams can use trust score insights alongside header analysis to assess domain reputation. This is particularly useful for organisations in Sydney, Melbourne, Brisbane and regional areas that receive high volumes of supplier, payroll and customer-service email.
Domain owners should publish SPF and DKIM correctly, enforce a DMARC policy gradually, and monitor aggregate reports for unauthorised senders. A dedicated sending subdomain, controlled DNS access and regular review of third-party platforms reduce the chance that a genuine campaign will resemble a phishing operation.
| Header or signal | What it can show | How to interpret it |
|---|---|---|
From |
The address displayed to the recipient | Easy to imitate; never use it alone |
DKIM d= |
The domain that created the signature | Compare it with the visible From domain |
dkim=pass |
The signature validated successfully | Confirms integrity, not brand identity |
| SPF result | Whether the sending server was authorised | Useful evidence, but it does not prove intent |
| DMARC result | Whether authentication aligns with From | A fail can expose impersonation |
| Reply-To | Where responses will be delivered | An unrelated address is a warning sign |
| Domain reputation | History and trust signals for the sender | Helps distinguish infrastructure from likely abuse |