Module dkim 

Trust the topmost Authentication-Results header to tell us which DKIM signatures passed.

Why “topmost”? The header is added by each MTA the message passes through; earlier hops’ headers are attacker-controlled if the attacker controls a relay along the path. Only the first header, added by our own MTA, is trustworthy. RFC 8601 §5 says the same thing.

We parse the header’s dkim=pass items and collect their header.d (the signing domain). A manifest’s require_dkim list is satisfied when at least one of the listed domains matches one of those.

Functions

passing_dkim_domains

Collect signing domains that pass DKIM, according to the topmost Authentication-Results header.

satisfies

Check whether at least one of wanted is in passing.