Property VerifyDkimLocally

Namespace

MailFathom.Application.Emails.Extraction

Assembly

MailFathom.Application.dll

VerifyDkimLocally

Gets or sets whether extraction verifies a message's own DKIM signatures where no trusted server did.

public bool VerifyDkimLocally { get; set; }

Property Value

bool

Remarks

It defaults to on because the deployment it exists for is one whose receiving server writes no Authentication-Results header at all. There, the sender verdict is not established on every message and the trusted-sender list has no identity to match against, so this is not an extra check over a working verdict — it is the only thing between that mailbox and a verdict that says nothing.

It is a fallback and never a supplement: an account whose server does write the header goes on believing that server and verifies nothing here, whatever this says.

Turning it off is what an operator who wants no egress at all from the extraction path sets, and it returns exactly the behaviour of a deployment that never had it. What is on the wire when it is on is <selector>._domainkey.<domain> — a name the signing domain published to be asked for, resolved when a message is stored rather than when one is read.