Overview
DKIM (DomainKeys Identified Mail) puts a digital seal on outgoing mail, like a wax seal on a letter. The sender's mail system stamps each message with a secret stamp, and anyone who receives the message can check the seal against a public copy the sender publishes. If someone changed the message along the way, the seal no longer matches. It is one of the results Sieve reads when it evaluates your mail.
How DKIM works
Before a message leaves, the sender's mail system stamps its important parts, the text you read and the sender and subject lines, with a seal only that system can make. On arrival, the receiving service looks up the public copy of the stamp and checks whether the seal still matches what arrived.
Two caveats keep it honest. The seal covers only what was stamped. And the company doing the stamping is not always the one named in the “From” line you see: a newsletter service may stamp with its own name, and so may an attacker. Checking that the two match is the job of DMARC.
A valid DKIM signature proves the signed content was not changed after signing. It does not by itself prove the signer is the brand you expect. That link is DMARC's job.
What a failure means
A broken signature means the content changed after it was sealed. Sometimes that is an attack. Just as often it is plumbing: a mailing list that appends a footer, or a forwarder that rewrites part of the message, breaks the seal in the process.
A missing signature is weaker evidence than a broken one: it simply means there is no intact seal to rely on, so the message has to stand on the other checks. What a receiving service does about either case depends on the domain's published policy, which is where DMARC comes in.
What Sieve shows you
When Sieve files a message as Malicious and authentication is part of the reason, your dashboard names the failed check, and DKIM is one of the names you will see. The message is filed under a label in your Gmail, never deleted, so you can always open it and judge for yourself.
If you know the sender is real, drag the message back to your inbox (or restore it from the dashboard). One correction restores the message and teaches your own filter about that sender.
History and sources
DKIM began as two separate, competing efforts: Yahoo's DomainKeys, built in 2004, and Cisco's Identified Internet Mail, built the following year. On June 1, 2005, the two companies announced they were merging the approaches into a single specification (Cisco's announcement), and submitted the combined result, DKIM, to the IETF the following month.
The IETF published that result as RFC 4871 in May 2007, a Proposed Standard. It was superseded by RFC 6376 in September 2011, when the IETF elevated DKIM to a full Internet Standard, designated STD 76, the small set of specifications the IETF considers fully mature.
Further reading: DKIM, explained by Google