Written by Psychevus
Published · Updated
Open the source of almost any email and near the top you’ll find a line like Authentication-Results: mx.google.com; dkim=pass; dmarc=pass. It looks like proof. It is really a note one mail server leaves for the next, and nothing stops a sender from writing a fake one further down the message.
The payment check on this site used to take that line at its word. I wanted it to look at the evidence underneath instead.
That evidence is the DKIM signature: a header the sending domain’s mail system adds, holding a hash of the body and a signature over a list of headers, made with a private key only that system has. The matching public key is published in DNS, where anyone can fetch it.
So anyone with the full message can redo the work. Hash the body, rebuild the signed headers, check the signature against the published key. If it passes, a mail system holding that domain’s private key signed this text, and the signed parts haven’t changed since. The header analyzer now does this in your browser. Only the signing domain and the name of its key are looked up; the message stays on your machine.
Two gaps are easy to miss. A signature only covers the headers it lists, and some senders leave Reply-To out. Then the reply address can be changed without breaking anything, which is exactly what a payment fraud needs. The other is the l= tag, which signs only the first part of the body. Anything added after that point, say a P.S. with different bank details, still passes.
The checker reports both. In the payment check, an unsigned tail on a bank-change email is enough to say stop.
Three more things a valid signature doesn’t settle on its own. A signer can set an expiry (x=); once it has passed, the signer asks you not to rely on the signature, so the checker marks it expired instead of passing it. Without an expiry, an old genuine email can simply be sent again and still verify. A valid signature also vouches for the From address only when the two line up the way that domain’s DMARC policy asks: some domains require the exact name (adkim=s), not just the same organisation, and the checker now looks that policy up. And a message with two From lines gets no vouching at all, because the signature can cover one while your mail program shows the other.
And a pass says nothing about who was typing. Much of the costliest supplier fraud comes from a real mailbox someone has broken into, and those messages are signed like any other. The signature narrows the question. The phone call to a number you already had answers it.
Copying a message out of a mail program can change it: line endings, a re-encoded attachment, a client that tidies up whitespace. So when a signature doesn’t verify, the tool says it couldn’t confirm the message, not that the message is fake. That is less dramatic, but it is what the evidence supports.
If you’d rather see it than read about it, there is a Lab instrument that signs a sample bank-change email in your browser and lets you tamper with it. Change the account number, reword the subject, point the reply address somewhere else, and watch which check breaks.
Updated 10 November 2026: this note’s title used to say a signature can’t lie. That overstated it. A valid signature can belong to an old message sent again, or fail to vouch for the From address at all, and the checker now reports expiry, strict alignment and duplicate From lines separately.
Short messages are fine.
Start a conversation