Allowed signing domains
Where DKIM needs to be used to validate the authenticity of a message (for example, for messages originating from Office 365 or Google Apps), the service checks that the signing domain matches the domain of the message content “From:” header. By default, if the domains do not match, the message will be considered spoofed.
Click Allowed Signing Domains to specify one or more additional DKIM signing domains that will be accepted to validate outbound messages from your hosted provider for sender domains in the policy.
In the panel that appears, add one or more signing domains, and click Save. Messages with a valid DKIM signature from a domain you have added will be treated as authentic.