How to authenticate with DKIM when sending on behalf of a gmail account?

when the email marketing service Sendinblue sends an email on behalf of my gmail account, gmail shows it to be authenticated w/ DKIM and says it’s

signed-by: sendinblue.com

Question: How can I send an from MiaB with a freemail account in the “From” header that’s still DKIM authenticated?

below is the code i used to send my email from MiaB as a gmail account, the resulting email from my gmail inbox, and a successful delivery from sendinmail with DKIM for comparison

#! /usr/local/bin/python
from smtplib import SMTP_SSL as SMTP
from email.mime.text import MIMEText

SMTPserver = "box.mailpotato.net"
destination = "zsdvzsdv1@gmail.com"
envelope_from = "me@mailpotato.net"
header_from = "stuart.clifford@gmail.com"
USERNAME = "me@mailpotato.net"
PASSWORD = "***"
text_subtype = "plain"
content = "Test Message"
try:
    msg = MIMEText(content, text_subtype)
    msg["Subject"] = "Sent from Python"
    msg["To"] = destination
    msg["From"] = header_from
    conn = SMTP(SMTPserver)
    conn.set_debuglevel(False)
    conn.login(USERNAME, PASSWORD)
    try:
        conn.sendmail(envelope_from, [destination], msg.as_string())
    finally:
        conn.quit()
except Exception as e:
    print(e)

the resulting email sent by ^ code:

Delivered-To: zsdvzsdv1@gmail.com
Received: by 2002:a05:7208:550f:b0:5e:f1af:829 with SMTP id t15csp4069772rbf;
        Tue, 20 Dec 2022 14:33:23 -0800 (PST)
X-Google-Smtp-Source: AA0mqf74ckl5QFK3fRcB19IDPdJewX9P4hp4l/mQKbSLSHf4kYJqlvaXEf9lr2jpfNzgs8cw1J9e
X-Received: by 2002:a05:6214:5985:b0:4c6:f789:f82d with SMTP id ll5-20020a056214598500b004c6f789f82dmr74178829qvb.24.1671575603037;
        Tue, 20 Dec 2022 14:33:23 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1671575603; cv=none;
        d=google.com; s=arc-20160816;
        b=zaMAVLgfyNQ3+VyV24rIjsqW2avF8P0Bg5jdkLMhGRM5w+4ht3bIitjghzGOEatNTW
         B6g9XOHESlEcNSjODP7xoUj8qAS2PiNX0ifIpXbQ/mIp1LYbKXcDLlpHxXu3RUuerSr4
         xvS04Adgw6XjJ79K7YmHoyIsSsjy3O6EyRzJcGMEKU5etXUvTD+wMjp0ksUbkXPl0LSt
         nKDsMJ5+YmB7hN/hbAAjCJ9HuLj05QDizc/unIleuLayHfFo2O7jYAguym595zbL4DCe
         msh9tpuLmaMGOgPF+PNsbBVqTdIvgXqsPMs/XCz0C+W5R/hQLyZx0cMlwNJZRWj0PLtA
         PbIw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=date:message-id:from:to:subject:content-transfer-encoding
         :mime-version;
        bh=0zm4HdljdW5c73P0NTJGrkEkSwAW+jQMpTe6xSMdk7E=;
        b=HZNFRdsRKMc8gYEikUYu/PxXjaFtWQkOcLVVKk4rjK6sA1bHiJ2LdoaJ93+WyRiBzp
         61MKsQy44gliqrC3Gj7XESIiAXU/3slhREbhadfUko0qGCe9L6MGiMiDwIumD5GVshkz
         RHoH0HA7Rtrk/wo5LMA+ZFBRFH/xuw7NFXkH6TY6rE/KaxkRy+VgM2AjvOyYo1r1OSvH
         BvnMyMOGKHI0wLugAxElO26rg/b/wFnIhrLoSvaGv8ELOalbyhJ8RMflu7ufE0dbYMQI
         qjg/kwWmuWnFsVv/20ECRD1S1tI2ONtYfzw6IeyRmkR0Uia+XMlQahDMaa5TmWXLog3C
         zCMQ==
ARC-Authentication-Results: i=1; mx.google.com;
       spf=pass (google.com: domain of me@mailpotato.net designates 2600:3c03::f03c:93ff:fe6a:6264 as permitted sender) smtp.mailfrom=me@mailpotato.net;
       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
Return-Path: <me@mailpotato.net>
Received: from box.mailpotato.net (box.mailpotato.net. [2600:3c03::f03c:93ff:fe6a:6264])
        by mx.google.com with ESMTPS id v18-20020a05620a441200b006fc2db94a39si6049029qkp.661.2022.12.20.14.33.22
        for <zsdvzsdv1@gmail.com>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Tue, 20 Dec 2022 14:33:23 -0800 (PST)
Received-SPF: pass (google.com: domain of me@mailpotato.net designates 2600:3c03::f03c:93ff:fe6a:6264 as permitted sender) client-ip=2600:3c03::f03c:93ff:fe6a:6264;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of me@mailpotato.net designates 2600:3c03::f03c:93ff:fe6a:6264 as permitted sender) smtp.mailfrom=me@mailpotato.net;
       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
Authentication-Results: box.mailpotato.net; dkim=none; dkim-atps=neutral
Received: from authenticated-user (box.mailpotato.net [23.239.12.88]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by box.mailpotato.net (Postfix) with ESMTPSA id 44042424D7 for <zsdvzsdv1@gmail.com>; Tue, 20 Dec 2022 17:33:22 -0500 (EST)
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Sent from Python
To: zsdvzsdv1@gmail.com
From: stuart.clifford@gmail.com
Message-Id: <20221220223322.44042424D7@box.mailpotato.net>
Date: Tue, 20 Dec 2022 17:33:22 -0500 (EST)

Test Message

email from sendinblue as same gmail account, to same gmail account as above:

Delivered-To: zsdvzsdv1@gmail.com
Received: by 2002:a05:7208:550f:b0:5e:f1af:829 with SMTP id t15csp3870305rbf;
        Tue, 20 Dec 2022 08:29:23 -0800 (PST)
X-Google-Smtp-Source: AA0mqf4HO9dsPeMKXEuVVhXEz3VqJwvIeHjkRyiR7YvikZCpigayO9GSBgMdOLjRegA2tOPdPZkI
X-Received: by 2002:a5d:670b:0:b0:242:15af:27f with SMTP id o11-20020a5d670b000000b0024215af027fmr27576893wru.28.1671553763507;
        Tue, 20 Dec 2022 08:29:23 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1671553763; cv=none;
        d=google.com; s=arc-20160816;
        b=r87Fj097f2GMpmI8nuQ1Ki7YpdJcQWZL9NRpZvZLDBGQ3R/4O0yEJGrngf2aoD8NDU
         bVmbGn4rFyo3tPvw9h+7MBD5/QlcHyapVHGuAS5wKjYllF2xpEVTfOTBMbwZn7oaMpqS
         lEqf/YJzDF9LK1m4PkSZivC4XW8Bau6BKNQpLJaitJcSWQL7XVu5+yU9SEPlh9gWJveQ
         EmK5Vat27KIdygWM+C6mLvLzJljbK9hbNWWrwRp7KZXc6v1cFLvbLeBM0vYC4qtBusfm
         9RgFjoy5qR8frlgK81Y7HcjGnfXm1IxkrxeC4paCWmrXb+fFMLRS0fwAcpxSiZsj0kIJ
         MB1A==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=reply-to:precedence:message-id:mime-version:list-unsubscribe-post
         :list-unsubscribe:list-id:from:feedback-id:date:subject:to
         :dkim-signature;
        bh=C/wbcU9xwZ0wCK6kNMUvhpNhPVCdntbnDzkVpvjpRyo=;
        b=G3DVPuYcf3MeSkfhZGT1nwlr8AABdiKb8e5gU7JTd/Y/lzmYYvl534Y7UJXPUdkGJF
         bvP6ychry/61b4XSxvfbNOvgEOBDT+/QSju/TBQlZLhzJi6ty1WJTnOn9s7mPKSKDeyq
         DWBbC+pfleuNoq7Zi84LBZ2dlVw6kthaL0R+uKhqeftoWbh9cDdooAytoHn7wohPD83O
         QxsNA41C5dWuR+VE7oBkPbSV8w4bIXz8rvBtkfsb2gpbEkdnGLqiMiTmZLB0d0y6aGWw
         A6PqVIpRmwmY8oyUNa555n7VU5cBhYSQGqO5UVRSLRT2k59wEjF1+6cgZ95/ZWYeVI+7
         R2+Q==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@sendinblue.com header.s=mail header.b=mQmqInRH;
       spf=pass (google.com: domain of bounces-9kc8j-stuart.clifford=gmail.com@kh.d.sender-sib.com designates 77.32.148.112 as permitted sender) smtp.mailfrom="bounces-9kc8j-stuart.clifford=gmail.com@kh.d.sender-sib.com";
       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
Return-Path: <bounces-9kc8j-stuart.clifford=gmail.com@kh.d.sender-sib.com>
Received: from kh.d.sender-sib.com (kh.d.sender-sib.com. [77.32.148.112])
        by mx.google.com with ESMTPS id v11-20020adf8b4b000000b00242079eb938si7495311wra.163.2022.12.20.08.29.23
        for <zsdvzsdv1@gmail.com>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Tue, 20 Dec 2022 08:29:23 -0800 (PST)
Received-SPF: pass (google.com: domain of bounces-9kc8j-stuart.clifford=gmail.com@kh.d.sender-sib.com designates 77.32.148.112 as permitted sender) client-ip=77.32.148.112;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@sendinblue.com header.s=mail header.b=mQmqInRH;
       spf=pass (google.com: domain of bounces-9kc8j-stuart.clifford=gmail.com@kh.d.sender-sib.com designates 77.32.148.112 as permitted sender) smtp.mailfrom="bounces-9kc8j-stuart.clifford=gmail.com@kh.d.sender-sib.com";
       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
DKIM-Signature: a=rsa-sha256; bh=C/wbcU9xwZ0wCK6kNMUvhpNhPVCdntbnDzkVpvjpRyo=; c=relaxed/relaxed; d=sendinblue.com; h=to:cc:from:reply-to:subject:date:mime-version:content-type:list-id:list-unsubscribe:x-csa-complaints:list-unsubscribe-post:message-id:sender:x-sib-id:x-mailin-client:x-mailin-campaign:feedback-id; q=dns/txt; s=mail; t=1671553763; v=1; b=mQmqInRHE7ktkCgBD0BzwsUhqaZ3WSB5YGUMc5rgYBlTU6h4DM9CGMoCcCzW+tWLaDh7Lp5i ZIaY6UyanOjCoZKBeXN810krkcI0qmn0BklZDw5vWDPHYwB5D0grU3hgp96UHTB80ajSnr4dNWR stTryYP2vc59netwkoZlx6HI=
To: <zsdvzsdv1@gmail.com>
Subject: SIB to mailtester
Content-Type: multipart/alternative; boundary="-------?=_89162-7652298551171"
Date: Tue, 20 Dec 2022 16:29:23 +0000
Feedback-ID: 77.32.148.112:5469217_2:5469217:Sendinblue
From: stuart <stuart.clifford@gmail.com>
List-Id: NTQ2OTIxNy0zLTI= <NTQ2OTIxNy0zLTI=.list-id.mailin.fr>
List-Unsubscribe: <mailto:unsubscribe@kh.d.sender-sib.com?subject=unsub-91fflcy7j&body=91fflcy7j>,<https://9kc8j.r.ag.d.sendibm3.com/mk/un/li/cA2WzsrfByw4yanUCjqMNttWs5OgHtSnQDfoh9BtMs437BSJnTlbEOCVkcw0sGi0bZtcdGAEQ3HqbcxNvHFJv8K9C-A13aA5eowzcZxioKq8v1ZeRT4l2rvEqNNYRTIDlglNyNj9qejuMbgxJhNSzNNlgM5f6SbpzEI>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
MIME-Version: 1.0
Message-Id: <202220121629.91fflcy7j@kh.d.sender-sib.com>
Precedence: bulk
Reply-To: stuart.clifford@gmail.com
X-Csa-Complaints: csa-complaints@eco.de
X-Mailer: Sendinblue
X-Mailin-Campaign: 2
X-Mailin-Client: 5469217
X-sib-id: Po9m6B-F2bQrjUCEpOKhSmj9mHuWlPua9YP0jFCcDErTJRNwORrp1DiG_iotBtpbGAgmAnsPEv-8NHRnfPbu45w963dQbsUaZVCKFeSpgGPVI5ROB3h_ELNX5p82LZ9NjhRKeAt4riJ1mmppPpnWSHa4pAfan2N0v1V3uOXzLacE6yW93yOSt2RoPNQo9-PCtQNWjgtGsVWKwYMK2cLwAms

---------?=_89162-7652298551171
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=UTF-8

Dear Customer,

This email will look and feel like a personal email you send to your audien=
ce. There are no images or graphics and no formatting. This way your reader=
s can really focus on the the email message without any distractions. take =
care now

=C2=A0

Best regards,

**Your Company**

[Click here to unsubscribe](https://9kc8j.r.ag.d.sendibm3.com/mk/un/0F2MpbI=
udBtWxxzoRGY6XWiBD3X6KT_2kdBf25Hn5erboD8vnVkfP-1y5mT5GsNuOkLgNZHdedb-DKG5qh=
_GaqeFtpu87SEGiDF_Rp9qX-Sh0TuqWwqm5_NqVuINXFUpWxlIBXxW-svhodyiOaIsP1iszvwQr=
ij-ejE)


---------?=_89162-7652298551171
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org=
/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns=3D"http://www.w3.org/1999/xht=
ml" xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micros=
oft-com:office:office">...</html>

---------?=_89162-7652298551171--

btw everything looks good re: SPF and DKIM when emailing as itself from miab

Delivered-To: zsdvzsdv1@gmail.com
Received: by 2002:a05:7208:550f:b0:5e:f1af:829 with SMTP id t15csp4019345rbf;
        Tue, 20 Dec 2022 12:57:20 -0800 (PST)
X-Google-Smtp-Source: AA0mqf7hAx+jBftm/REIqTliDBuf42OQNjyKPwsch2K+VJfzodRUTqgG3U1LWh8xlklhWUq/Zjtl
X-Received: by 2002:a05:622a:40ca:b0:3a6:ee87:20e7 with SMTP id ch10-20020a05622a40ca00b003a6ee8720e7mr65667714qtb.68.1671569840614;
        Tue, 20 Dec 2022 12:57:20 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1671569840; cv=none;
        d=google.com; s=arc-20160816;
        b=udkg0zkp9GL5msTguwJvUvX9eYL0iNi94LhnnorAC5IRA2AHpBVZf8wuJndMW1TzZc
         39QSRun7g0pvGmR83y5cg+RG6N24aICLnn47vsz8kBdSt47Mx5AhD6AKAZsXIffAD644
         Nqq0CBmX/QOET1QMUxUMWbckJd9jPG0l2N+eai590z8EBwobNZS6h83O/foN4X4vTmif
         I95KudYpMF17WmBDQWLNNtQRgiEQ2JOCtWEGI3aqtABK0dz/LaJtDpSvqoxjEoyu7Kjm
         Qxr1bOlTgMfk8JUxuMBN1whf4DaioGR4q6mArMWrA6r1zCI72GvwUPZDbajdhDZ5ClsE
         Z8fg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=from:date:message-id:subject:content-transfer-encoding:mime-version
         :dkim-signature;
        bh=PkbvdhgKiEAAhc+GiwM2ZnxMu+StJ76lWGj3Y9phfFA=;
        b=sV87nhKfQYd2X0kNZD/zlyR1DVS5RRVKEaE+RPErbD+gGrGi4vh+h24F60s/pvkT4j
         NYhhPQiswXazpNhvELxfOz6WtVePPBV5KbPJN+iWdwhwyNPdVoYSz1uX2jw11dQw5XMU
         XLuN4t9q2hYSC5coLw7zDcOih/wpHAqJHyKZb63dJDsciXKjtwtss268S8Pm17Kd6gaV
         CpH9LIC+imTcdp0iwDekE4Ae3jsVFUv0s9ozAB+Qwv0p1FX/0ca8ThdRuCfMzU6gSZl8
         0pGAFe2zSkqdjRZYl4gjMp6TuJPTVkFVk+gDMh0iQm4epCta+gbozytgbP/ncE54z8zO
         UAzQ==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@mailpotato.net header.s=mail header.b=baf+QTZK;
       spf=pass (google.com: domain of me@mailpotato.net designates 23.239.12.88 as permitted sender) smtp.mailfrom=me@mailpotato.net;
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=mailpotato.net
Return-Path: <me@mailpotato.net>
Received: from box.mailpotato.net (box.mailpotato.net. [23.239.12.88])
        by mx.google.com with ESMTPS id 2-20020ac85642000000b003a82347f47asi5721744qtt.36.2022.12.20.12.57.20
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Tue, 20 Dec 2022 12:57:20 -0800 (PST)
Received-SPF: pass (google.com: domain of me@mailpotato.net designates 23.239.12.88 as permitted sender) client-ip=23.239.12.88;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@mailpotato.net header.s=mail header.b=baf+QTZK;
       spf=pass (google.com: domain of me@mailpotato.net designates 23.239.12.88 as permitted sender) smtp.mailfrom=me@mailpotato.net;
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=mailpotato.net
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mailpotato.net; s=mail; t=1671569840; bh=PkbvdhgKiEAAhc+GiwM2ZnxMu+StJ76lWGj3Y9phfFA=; h=Subject:Date:From:From; b=baf+QTZKfza8xYuH1eIoEumWmTXqMckVuyDCAgXSiZgZK7oSlyzU0oxQa/zSWqocM
	 7mAEBcZcMttuC8yUzMUOctmi61LhaqyAX7VhKclbMfkpbdl2jz/6UADGH0RT5yoDXM
	 r9q/lJmRgGJZkwRQYcDuVw0Fnj4iDkTuI8NU/gaVplts23vOo9VFRc8qCxtjq5p+e0
	 fpvPw7YNkCzBRs4b4qUNHilfPwb05+PKgP20DKYIUBkcd9Bhbe5/B/Yq62PQ+JjJP8
	 VKV+q7eI+GtfRo+ndftHhecKoi0rXZOApTxCUDUcNedak3INyzU6dHT1wJT5ev3plG
	 QfVljkXRbNBAw==
Received: from authenticated-user (box.mailpotato.net [23.239.12.88]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by box.mailpotato.net (Postfix) with ESMTPSA id EFBB642333; Tue, 20 Dec 2022 15:57:19 -0500 (EST)
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Sent from Python
Message-Id: <20221220205719.EFBB642333@box.mailpotato.net>
Date: Tue, 20 Dec 2022 15:57:19 -0500 (EST)
From: me@mailpotato.net

Test message

okay… i’m realizing that the DKIM signature actually contains the “From” header value to prevent it from getting modified by a villain:

https://mailtrap.io/blog/create-dkim-tutorial/

Choose a domain
When validating DKIM signatures, the recipient’s mail server checks whether the domain included in the signature (d=) matches the domain included in the ‘From:‘ field of the email. You may use different domains for sending different types of emails, so make sure each is authorized.
NB: If you’re using different domains for sending emails, you’ll need to have separate DKIM signatures for each domain.

anyone have any recommendations on how to approach this w MiaB?

well now i’m even more confused cos that mailtrap link says

When validating DKIM signatures, the recipient’s mail server checks whether the domain included in the signature (d=) matches the domain included in the ‘From:‘ field of the email.

but in my email sent by sendinblue but “From:” a gmail account, the DKIM signature’s d= value is sendinblue.com

D:

DKIM-Signature: a=rsa-sha256; bh=C/wbcU9xwZ0wCK6kNMUvhpNhPVCdntbnDzkVpvjpRyo=; c=relaxed/relaxed; d=sendinblue.com; h=to:cc:from:reply-to:subject:date:mime-version:content-type:list-id:list-unsubscribe:x-csa-complaints:list-unsubscribe-post:message-id:sender:x-sib-id:x-mailin-client:x-mailin-campaign:feedback-id; q=dns/txt; s=mail; t=1671553763; v=1; b=mQmqInRHE7ktkCgBD0BzwsUhqaZ3WSB5YGUMc5rgYBlTU6h4DM9CGMoCcCzW+tWLaDh7Lp5i ZIaY6UyanOjCoZKBeXN810krkcI0qmn0BklZDw5vWDPHYwB5D0grU3hgp96UHTB80ajSnr4dNWR stTryYP2vc59netwkoZlx6HI=
To: <zsdvzsdv1@gmail.com>
Subject: SIB to mailtester
Content-Type: multipart/alternative; boundary="-------?=_89162-7652298551171"
Date: Tue, 20 Dec 2022 16:29:23 +0000
Feedback-ID: 77.32.148.112:5469217_2:5469217:Sendinblue
From: stuart <stuart.clifford@gmail.com>
List-Id: NTQ2OTIxNy0zLTI= <NTQ2OTIxNy0zLTI=.list-id.mailin.fr>

SOLVED

^ link contents pasted below:


/etc/opendkim.conf

Syslog          yes
UMask           002
KeyTable        /etc/mail/dkim_key_table
SigningTable    refile:/etc/mail/dkim_signing_table

Note that SigningTable has refile: in it’s definition, this specifies that the file includes regular expressions; in our case the * wildcard.

/etc/mail/dkim_key_table

keyname  example.com:selector:/etc/mail/selector.key

Here keyname is used to match the key between this file and the dkim_signing_table file. In my real file I named this the same as my selector.

example.com and selector should be replaced which the domain and selector that you wish to be used in your signature’s d= and s= respectively.

/etc/mail/dkim_signing_table

*   keyname

This file simple maps address found in the From: header to a key in the dkim_key_table. In this case we want all email’s sent via this server to be signed with the same key, so a * wildcard is used.