The chain of logic was like this: 1. We want to sign using DKIM.
So far so good.
2. For that we need to make sure each outgoing From address is something the
domain owner is happy to sign for.
That's the problem. What's special about the From: line? Do you
check to ensure that signed mail doesn't contain viruses, or Ponzi
schemes or hate speech or child pornography or any of a zillion other
things that well run mail systems wouldn't want to send?
I let my users change the From: line to whatever they want, and sign
it all with my main domain. If the From: line happens to contain an
address in a domain for which I have a signing key, I also sign with
that.
R's,
John