DKIM signing-domain mismatch
Unexpected d= domain relative to the visible From domain.
Problem summary
Unexpected d= domain relative to the visible From domain.
Symptoms
- Visible From domain differs from DKIM d=
- Brand mail signed as a parent, sibling, or vendor domain
- Stakeholders see unexpected signing identity in headers
Possible causes
- Shared selector/domain configuration across brands
- Wrong domain selected in the ESP UI
- Intentional third-party signing without alignment plan
How to diagnose
- Inventory From domains vs d= values per stream
- Determine which mismatches break DMARC vs are merely surprising
How to fix
- Sign with d= equal to the From domain (or alignable org domain)
- Split selectors per brand/stream
- Document any intentional third-party d= and DMARC impact
How to verify
- Production headers show expected d=
- DMARC alignment matches the design
Prevention
- Per-stream identity table: From, MAIL FROM, DKIM d=, selector
- Change tickets require identity table updates
When to escalate
- Production mail is failing for a material share of recipients after remediation attempts