DKIM, SPF and DMARC

How FOLD verifies DKIM signatures itself and combines them with the SPF and DMARC results of your mail server.

FOLD judges a sender from two sources: the results your own mail server recorded when the message arrived, and its own DKIM check. Both run on Mac, iPhone and iPad.

Your server’s results

Receiving servers add an Authentication-Results header with their SPF, DKIM and DMARC verdicts. A sender can add such headers too, so FOLD trusts only a header whose server name matches the IMAP server of your account exactly. All other copies are ignored.

FOLD takes SPF and DMARC from this header; it does not evaluate SPF itself. If your provider writes the header under a different name than its IMAP server, FOLD has no SPF or DMARC verdict for your mail and shows the neutral state described under indicators.

FOLD’s own DKIM check

For every DKIM-Signature in a message, FOLD:

1. Requires that the From header is among the signed headers.
2. Recomputes the body hash with the signature’s canonicalization (simple or relaxed).
3. Fetches the public key from DNS (selector._domainkey.domain).
4. Verifies the signature with rsa-sha256 or ed25519-sha256.

Rejected are rsa-sha1 signatures, RSA keys shorter than 1024 bits, and keys that the domain has revoked. A signature from a key marked as testing (t=y) is not counted as a pass.

How the results combine

The own DKIM check can confirm or tighten your server’s verdict, never soften it:

• A valid signature from the sender’s domain confirms DKIM.
• An invalid signature that claims the sender’s domain turns the message into Sender could not be verified, even if your server said otherwise. Mailing lists are exempt, because they change messages legitimately.
• DNS errors or a missing key leave your server’s verdict unchanged and show as not verifiable.

DMARC counts as aligned when the passing domain matches the sender’s domain or shares its last two labels. FOLD does not use the Public Suffix List yet, so for domains under suffixes like co.uk this comparison is too lenient. A message with more than one From header is always treated as possible spoofing.

When the check runs

FOLD checks a message when it first downloads the full message: when you open it, or when it loads the next message in advance. The message appears immediately; the verdict follows a moment later. The DNS queries go to the resolver your device uses.

The result is saved with the message. If DNS failed, FOLD tries again the next time you open the message with a connection.