---
title: DKIM
url: 'https://docs.danami.com/warden/user-guide/antispam-plugins/dkim'
markdown: 'https://docs.danami.com/warden/user-guide/antispam-plugins/dkim.md'
date: '2026-10-02'
description: 'This plugin implements DKIM lookups as described by the RFC 4871, as well as historical DomainKeys lookups, as described by RFC 4870, thanks to the support for both types of signatures by newer versions of module Mail::DKIM. How it works This plugin requires the Mail::DKIM Perl module to operate. I…'
taxonomy:
  category:
    - docs
  tag:
    - dkim
---

[](#)  [ Basics ](https://docs.danami.com/warden/)     [ User Guide ](https://docs.danami.com/warden/user-guide)     [ Anti-spam Plugins ](https://docs.danami.com/warden/user-guide/antispam-plugins)      DKIM    

# DKIM

This plugin implements DKIM lookups as described by the [RFC 4871](http://ietf.org/rfc/rfc4871.txt), as well as historical DomainKeys lookups, as described by [RFC 4870](http://ietf.org/rfc/rfc4870.txt), thanks to the support for both types of signatures by newer versions of module Mail::DKIM.

## How it works

This plugin requires the `Mail::DKIM` Perl module to operate. It verifies the DKIM (RFC 4871) and historical DomainKeys (RFC 4870) signatures present in a message.

When no valid signature from the author's domain is found, the plugin evaluates the ADSP (Author Domain Signing Practices, RFC 5617) record published by the author domain and fires the corresponding `DKIM_ADSP_*` rules.

## Tags

The DKIM plugin adds the following tags that are available for use in reports, header fields, and other plugins:

| Tag | Description |
|---|---|
| `_DKIMIDENTITY_` | Agent or User Identifier (AUID) (the 'i' tag) from valid signatures |
| `_DKIMDOMAIN_` | Signing Domain Identifier (SDID) (the 'd' tag) from valid signatures |
| `_DKIMSELECTOR_` | DKIM selector (the 's' tag) from valid signatures |

Identities and domains from signatures which failed verification are not included in these tags. Duplicates are eliminated (e.g. when there are two or more valid signatures from the same signer, only one copy makes it into a tag). Note that there may be more than one signature in a message - currently they are provided as a space-separated list, although this behaviour may change.

## Rules

> > > > > When a rule lists four scores: the first applies when neither the Bayesian classifier nor network tests are in use, the second when only network tests are in use, the third when only the Bayesian classifier is in use and the fourth when both are in use.

| Area | Rule name | Description | Default scores |
|---|---|---|---|
| header | `USER_IN_DKIM_WELCOMELIST` | From: address is in the user's DKIM whitelist | -100.000 |
| header | `USER_IN_DEF_DKIM_WL` | From: address is in the default DKIM white-list | -7.500 |
| full | `DKIM_SIGNED` | Message has a DKIM or DK signature, not necessarily valid | 0.1 |
| full | `DKIM_VALID` | Message has at least one valid DKIM or DK signature | -0.1 |
| meta | `DKIM_INVALID` | DKIM or DK signature exists, but is not valid | 0.1 |
| full | `DKIM_VALID_AU` | Message has a valid DKIM or DK signature from author's domain | -0.1 |
| full | `DKIM_VALID_EF` | Message has a valid DKIM or DK signature from envelope-from domain | -0.1 |
| header | `DKIM_ADSP_NXDOMAIN` | No valid author signature and domain not in DNS | 0 0.8 0 0.9 |
| header | `DKIM_ADSP_DISCARD` | No valid author signature, domain signs all mail and suggests discarding the rest | 0 1.8 0 1.8 |
| header | `DKIM_ADSP_ALL` | No valid author signature, domain signs all mail | 0 1.1 0 0.8 |
| header | `DKIM_ADSP_CUSTOM_LOW` | No valid author signature, adsp\_override is CUSTOM\_LOW | 0.001 |
| header | `DKIM_ADSP_CUSTOM_MED` | No valid author signature, adsp\_override is CUSTOM\_MED | 0.001 |
| header | `DKIM_ADSP_CUSTOM_HIGH` | No valid author signature, adsp\_override is CUSTOM\_HIGH | 0.001 |
| full | `DKIM_VERIFIED` | eval:check\_dkim\_valid() | 0 |
| header | `DKIM_POLICY_TESTING` | eval:check\_dkim\_testing() | 0 |
| header | `DKIM_POLICY_SIGNSOME` | eval:check\_dkim\_signsome() | 0 |
| header | `DKIM_POLICY_SIGNALL` | eval:check\_dkim\_signall() | 0 |

## Related Pages

- [DKIM Settings](https://docs.danami.com/warden/settings/antispam/plugin-settings/dkim "DKIM Settings")

 [](https://docs.danami.com/warden/command-line-interface/antispam/antispam-plugin-dkim)

---

## Navigation

- Parent: [Anti-spam Plugins](https://docs.danami.com/warden/user-guide/antispam-plugins.md)
- Previous: [DecodeShortUrls](https://docs.danami.com/warden/user-guide/antispam-plugins/decodeshorturls.md)
- Next: [DMARC](https://docs.danami.com/warden/user-guide/antispam-plugins/dmarc.md)