Every Authentication-Results header value
on the message, topmost first.
The domain of the From address.
ok when the topmost header's authserv-id is mx.google.com
and it has a dkim=pass clause whose signing domain matches the
sender's domain (isDkimDomainMatch: its gappssmtp alias
counts only for a two-label domain); otherwise not ok, with a reason.
Check a message's DKIM authentication against its sender's domain.
Only the topmost
Authentication-Resultsheader is trusted — the one Google's receiving MX added last (Gmail's metadata header list preserves arrival order, so it isauthResultsValues[0]). Any lower header with the same authserv-id can be forged by the sender (it was on the message before Google ever saw it), so it is never consulted, even to look for amx.google.commatch further down.