Does a DKIM signature include the 'From' header by default?

The short answer is yes, absolutely. For a DKIM signature to be valid and serve its purpose, the 'From' header field must be included in the set of signed headers. It's not just a recommendation; it's a fundamental requirement of the DKIM standard.

DKIM, or DomainKeys Identified Mail, works by adding a digital signature to email messages. This signature acts as a tamper-proof seal, allowing the receiving mail server to verify that the email was actually sent from the domain it claims to be from and that its content hasn't been altered in transit. As TechTarget explains, this signature is attached to the email's header.

Email on Acid says:

Visit website

The DKIM signature header gets added to email messages and includes the information receiving mail servers need to verify the authenticity of a message.

Without signing the 'From' header, the entire authentication process would be compromised.

Suped DMARC monitor

Free forever, no credit card required

Get started for free

Trusted by teams securing millions of inboxes

When an email is signed with DKIM, a DKIM-Signature header is added to the message. This header contains several tags, each providing a piece of information for the verification process. One of the most important tags is the h= tag, which is a colon-separated list of the header fields that have been included in the cryptographic signature.

IETF Datatracker says:

Visit website

The 'h=' tag of the DKIM-Signature header field is a colon-separated list of header field names that lists the header fields that were included in the signature algorithm. This tag MUST contain the From header field.

According to the official standard, RFC 6376, the 'From' field is mandatory and must be present in this list. While many other headers can also be signed to enhance security, the 'From' header is the non-negotiable foundation. Some other headers that are typically signed include:

• To
• Cc
• Date
• Subject
• Message-ID

The entire point of DKIM is to prevent email spoofing by verifying the sender's domain. The 'From' header is what the recipient sees as the sender of the email. If this header weren't signed, a spoofer could send a DKIM-valid email that passes verification, then simply modify the 'From' header to impersonate a legitimate sender. Signing it locks it in, ensuring its integrity.

This becomes even more important when you consider DMARC (Domain-based Message Authentication, Reporting, and Conformance). For DMARC to pass, it requires something called "identifier alignment." For DKIM alignment, this means the domain in the d= tag of the DKIM signature (the signing domain) must match the domain in the 'From' header. If the 'From' header wasn't part of the signature, its contents couldn't be trusted, making the alignment check impossible and rendering DMARC ineffective.

Mailgun says:

Visit website

“b=” refers to the message’s unique DKIM signature of headers and body, encoded with Base64. “bh” refers to a digital hash value that contains a snapshot of the message’s body.

In summary, the inclusion of the 'From' header is not an optional feature of DKIM; it is the core component that enables it to function as a reliable email authentication standard. Every valid DKIM signature is built upon the promise that the 'From' field, among other headers and the message body, has been verified and secured.