Suppose no DKIM keys are defined for
sub.example.com, but a key with selector
mykey is defined for
example.com; that is, a DKIM record exists at
mykey._domainkey.example.com in the DNS. Can
<email@example.com> send mail that is signed using the key described in that DNS record? That is, does
sub.example.com inherit the keys defined for its parent,
example.com, if it has no keys defined for itself? I can't seem to find any info about this, neither online in general nor in the RFCs.
A separate, but related concern: For now, I am using the parent domain as the SDID; that is, email sent from
<firstname.lastname@example.org> has a
DKIM-Signature header with
d=example.com. Receiving mail servers state that it passes the DKIM test, as well as the DMARC test when
example.com has a DMARC policy of
p=reject;sp=reject;adkim=r. Despite this passing the tests, is this good practice? Would it be better from the perspective of receiving mail servers if
sub.example.com had its own DKIM record as well, and then mail from that domain had
d=sub.example.com in the
I ask this because email for
sub.example.com which has
d=example.com seems to be flagged as spam, and it occurred to me that, for example, email from
<email@example.com> or whatever domain could be signed by a key for
example.net and pass the DMARC test as long as the
DKIM-Signature header has
d=example.net. Is this correct, and if so, is this a common/valid spam tactic? If so, are there any measures I can take to prevent spammers from abusing this vulnerability in order to appear as if they are sending mail from domains (or subdomains thereof) that I administer?
It looks like I would have to explicitly define SPF/DKIM/DMARC policies for all domains/subdomains that I intend to send mail from in order to achieve utmost authenticity, but this is undesirable because it is time consuming to maintain. Even then, the DKIM vulnerability described above could still be taken advantage of.