Oceniono na 2 z 5 możliwych gwiazdek

autor: apassi wystawiona: Sty. 30, 2026 ·

Dear developer,
First of all, thank you for maintaining DKIM Verifier — it’s a valuable tool for inspecting email authentication. After extensive testing with real-world messages (including transactional emails from banks and major providers routed through Microsoft 365), I’d like to offer some constructive feedback to clarify how the add-on behaves and how its results are interpreted.
Key observations:
1. DKIM “Invalid” ≠ Forged or Malicious
Many legitimate emails show “Invalid (E-Mail was modified)” due to intermediate modifications by trusted relays (e.g., Microsoft’s mail.protection servers). These include added headers, MIME changes, or encoding adjustments that break the original DKIM signature. This is expected behavior, but users may misinterpret it as a security issue.
2. Authentication-Results header is essential
The actual SPF/DKIM/DMARC verdict from the receiving server (shown in the Authentication-Results header) often provides a more accurate picture of message legitimacy than re-verifying DKIM alone. It would be helpful if the add-on emphasized this distinction more clearly — perhaps with a tooltip or optional overlay.
3. DKIM Verifier is excellent for spotting forged messages
When DKIM is missing, malformed, or signed by a mismatched domain, the add-on correctly flags these as suspicious. In such cases, the “Invalid” result is meaningful and actionable.
4. The DKIM button view lacks context
The popup accessed via the toolbar button shows DKIM status, selector, and signed headers, but it doesn’t explain why the signature failed or whether the failure is benign (e.g., due to Microsoft’s processing) or critical (e.g., forged domain). Including a short summary or link to interpretation guidance would help non-technical users.
5. SPF and DMARC status are not surfaced
Since DKIM alone is not sufficient to assess message authenticity, it would be valuable if the add-on optionally displayed SPF and DMARC results from the Authentication-Results header alongside DKIM status.
Suggestion:
Consider adding a “DKIM failed due to message modification by trusted relay” note when the failure matches known patterns (e.g., Microsoft 365, Gmail). This would reduce false alarms and help users focus on genuinely suspicious messages.
Thanks again for your work — the add-on is powerful, and with a few usability tweaks, it could be even more effective for everyday users and security-conscious professionals alike.
Best regards,
[A user from Finland testing DKIM Verifier with real-world banking and Microsoft 365 messages]