Mail servers on the outer boundary of the domain's infrastructure use the private DKIM key to generate a signature (properly an encrypted hash) of the entire message body, including all headers ...