With DKIM alone, there is no way to be sure. DKIM is designed for validating that email content is trustworthy i.e. hasn't changed during delivery. The key used for signing is verified against public DKIM key in DNS, but the same domain can have several keys for different purposes and the selector can be anything, e.g. mta1._domainkey
or whatever._domainkey
and is only introduced in the flag s=selectorname
of DKIM-Signature
header.
If the sender has also implemented DMARC, it is a clear indication that there should be both DKIM and SPF. Therefore:
- If a domain has
_dmarc.example.com. TXT "v=DMARC1; p=...
there should be DKIM. The DMARC record also tells what to do with messages not passing the test.
- If there is no
_dmarc TXT
, they may or may not have DKIM.