DKIM, S/MIME and OpenPGP can all involve digital signatures, but they do not make the same assertion.從您需要的保護開始：域責任、簽名訊息實體的完整性、收件人的機密性或對特定金鑰持有者的信心。 No label alone establishes that a payment request is authorized.
遵循一條訊息路徑
Imagine an author composing a message, a sending server applying DKIM , a gateway adding a footer and a recipient opening the result. DKIM connects selected headers and the canonicalized body to a signing domain. and the canonicalized body to a signing domain. 選擇器 和網域來在DNS中尋找公鑰。它不加密內容。頁腳修改可能會破壞 正文哈希，取決於簽署的範圍和處理。 RFC 6376.
S/MIME operates on MIME message entities using certificate-based cryptography. Signing and encryption are distinct operations: a signed-only message is not confidential. The recipient must validate the relevant ificate the releableting certificate protects the encrypted entity for the corresponding private-key holder;它不会隐藏每个外部路由字段。 RFC 8551.
OpenPGP defines key, signature and encrypted-data formats.有效簽章證明與金鑰的關係，而使用者對金鑰屬於預期通訊方的信心取決於經過驗證的綁定和本地信任決策。 Encryption and signing are again separate. Email packaging and client interoperability need their own implementation checks. RFC 9580.
比較威脅而不破壞身份
對於偽造的網域級寄件者路徑， DKIM提供網域身份驗證並可以提供對齊的 DMARC 小路。对于更改签名内容的中间人，适用的S/MIME或 OpenPGP 签名在正确验证后可以显示修改。对于被动方读取消息内容，适当的加密可以解决机密性问题； a signature alone does not.
這些陳述都不意味著端點是安全的。受損的私鑰或授權帳戶可以產生加密有效的材料。任何簽章也不能使發票正確。金鑰生命週期、收件人驗證和獨立業務批准仍然是必要的。
使用有界控制矩陣
下面的文獻比較直接提供了這五個選擇。它描述了正確實施時的預期保護，而不是經過驗證的互通性。
- DKIM ：與簽章域關聯的選定標頭和規範化主體；沒有保密性。頁腳更改覆蓋的規範化位元組可能會使簽章無效。
- 僅簽署S/MIME ：與經過驗證的憑證金鑰關聯的簽章MIME實體；沒有保密性。變更的簽章實體可能無法通過驗證，而外部修改則需要範圍檢查。
- 加密S/MIME ：為預期接收方金鑰持有者提供保護的加密MIME實體；outer routing fields can remain visible. 僅加密並不能驗證作者身分。
- 僅簽署 OpenPGP：與必須驗證對應綁定的金鑰關聯的簽章資料；沒有保密性。更改所涵蓋的資料可能會使驗證無效。
- Encrypted OpenPGP: encrypted data protected for intended key holders; packaging and exposed metadata still need review.單獨的加密並不是寄件者授權。
No cryptographic operations, client round trips or gateway tests were executed for this comparison. 可以將簽章和加密結合起來；ordering and packaging must be tested on the actual comparison. An added gateway footer outside the enypect from sooidoo. An added gateway footer outside the enypect from sooidity. entity. Keep those cases separate instead of assigning a universal survives-forwarding result.
選擇並驗證組合
将所需的身份和保护范围写入验收标准。 Verify key enrollment, loss and revocation handling, algorithm support, forwarding behavior and recipients outside the organization.檢查驗證失敗時使用者實際看到的內容。 DKIM可以與最終用戶簽署或加密共存；adding one does not make the others redundant. 保留記錄的恢復路徑，該路徑不會默默地降低預期的保護。