Conditionally skip filtering based on valid+aligned DKIM signature for specific domain(s)?

[SiriusNZ]

Hi all,

I'm wondering if anyone has had any luck whitelisting trusted domains conditional on having an aligned and passing DKIM signature for in the message?
The goal is to only skip filtering for messages from that trusted domain that are authenticated. This way it's a whitelist that is not blind, but validates the origin.

In a previous job, with either Exchange+SpamTitan or with Exchange on MS365, I'd do this by having a regex to match "dkim=pass.*header.d=domain.com" from the Authentication-Results for each domain we'd want to pass this way.

But it would seem that that header is unavailable to do the same in PMG using a "Match Field" What rule.

I was wondering if there were any alternatives/hacks anyone has tried to have a whitelist or similar rule based on the domain alignment and passing of a DKIM signature?

If not, would such an ability be worthy of a feature request?

 

[SiriusNZ]

I tried using a Who object as a "conditional whitelist" and tried to use a header match for X-SPAM-LEVEL to see if a message matched DKIM_VALID_AU, but that turned out to be a dead end, as it appears PMG adds X-SPAM-LEVEL after the filter.

I suppose I could set up OpenDMARC on my PMG server but I'm reluctant to go customizing it in case it breaks any future updates.

Anyone with any better ideas before I go down that road?