DKIM glossary
What does the d= tag mean in a DKIM signature?
By Samuel Chenard · CEO & Co-Founder, Palisade · Reviewed July 15, 2026
The d= tag in a DKIM-Signature names the signing domain (the SDID) — the domain taking responsibility for the message and where receivers fetch the public key. For DMARC, d= must align with the From: header domain, so it decides whether a passing DKIM signature actually helps you pass DMARC.
d= at a glance | |
|---|---|
| Tag | d (signing domain / SDID) |
| Valid values | A domain you control and can publish a key under, e.g. example.com |
| Default | Required — a DKIM signature is meaningless without a signing domain. |
| Where it goes | In the DKIM-Signature header, alongside the s= selector. |
How d= works
d= answers a single question: who is vouching for this message? It names the domain that signed it, and it tells the receiver where to look for the public key — <selector>._domainkey.<d-value>. The signature asserts that this domain takes responsibility for the message, and nothing more.
On its own, a valid signature only proves the d= domain signed the mail. DMARC adds the test that matters: it checks whether d= aligns with the domain in the visible From: header. Mail sent from you@example.com and signed with d=example.com aligns, so the DKIM leg of DMARC passes. Alignment can be strict or relaxed — see the adkim tag for the difference.
This is where the classic trap lives. An email service provider often signs your campaigns with its own domain — say d=esp-mail.com. DKIM passes, because the ESP's signature is valid, but DMARC fails alignment because d= isn't your From: domain. The fix is to configure custom-domain (branded) DKIM signing at the ESP so d= becomes your domain.
Correct record vs common mistake
Correct
From: you@example.com
DKIM-Signature: ...; d=example.com; s=s1; ...The signing domain matches the From domain, so DKIM is aligned and DMARC's DKIM check passes.
Common mistake
From: you@example.com
DKIM-Signature: ...; d=esp-mail.com; s=s1; ...The ESP signs with its own domain. DKIM verifies, but d= doesn't align with the From domain, so DMARC still fails — the reason to enable custom-domain signing.
Troubleshooting d=
| Issue | Likely cause | Fix |
|---|---|---|
| DKIM passes but DMARC fails | d= is the ESP's domain, not aligned with the From domain | Enable custom-domain DKIM at the sender so d= becomes your domain |
| Receiver can't find the public key | d= or the selector points at a domain with no published key | Publish the key at <selector>._domainkey.<d-domain> and let DNS propagate |
| Subdomain mail fails alignment | d= is the parent domain but From uses a subdomain under strict alignment | Sign with a matching d=, or set DMARC adkim=r (relaxed) if the organizational domain is shared |
Why it matters for MSPs
Every client that sends through a marketing platform, help desk, or invoicing tool risks this ESP-signs-with-its-own-domain trap. Across dozens of tenants it means DKIM looks green while DMARC quietly fails alignment — and you can't safely reach reject until each sender signs with the client's own d= domain.
Trusted by MSPs
“I've migrated all my clients from PowerDMARC. The agent was so powerful it allowed us to do the work in a fraction of the time.”
Marc-Olivier Hardy — VP & CTO, CDT Connexion
DMARC software that does the work
Palisade reads each client's reports to spot exactly which senders sign with the wrong d=, flags the ones failing alignment, and guides them onto custom-domain signing — so every legitimate source aligns before the domain moves to reject.
1 domain free up to 1,000 emails/month
Questions readers ask