DKIM
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email so receivers can verify, with a public key in DNS, that the message came from the domain and was not altered.
How it works
The sending server signs selected headers and the body; the DKIM-Signature header names the domain (d=) and the selector (s=) used to find the key at selector._domainkey.domain.
A valid signature from a look-alike domain proves nothing about the brand, so check which domain signed.
How to protect yourself
- Sign all outgoing mail, rotate keys and use at least 2048-bit RSA.
- When analysing a message, compare the d= domain with the visible From domain.