DKIM can verify the domain, but most email scams are already done from cousin domains, which DKIM doesn't solve... and will happily report as valid, providing the scammers have set it up on their domain.
Organization signing would be a whole different thing. Something like Extended Validation for SSL/TLS.
Re:Why is no one signing their emails?
by massaman_yams on Wednesday March 13, 2019 @12:09PM
(#19380066)
BIMI is... sort of what you're looking for. https://authindicators.github.io/rfc-brand-indicators-for-me...
Re:Why is no one signing their emails?
by rstuart4133 on Wednesday March 13, 2019 @09:58PM
(#19385901)
> This is a thing: DKIM.
I'm with you, purely for selfish reasons. The first thing I do when I suspect phishing is look in the raw email source for the DKIM signature.
It would be trivial to expose the DKIM signature in the UI. Things like whether the signature was good, what domain(s) signed the email, and what was signed would be very handy.
Lets email servers and domain owners attest that a message was sent by them. For instance, gmail can apply a DKIM to all outbound emails, to verify that it's sent by gmail, and that they authenticated the person that it was sent as. For example, here's one of gmail's DKIM public keys:
If you get email from a domain that uses DKIM (you can use DMARC to tell), then you can reject that email if it's not signed, or if the signature is invalid. Companies can set this up on their mail servers, so it just works for every email client effortlessly.