Method GetDKIMKeyInternal

internal/identity/store.go:587–606

GetDKIMKeyInternal returns the stored selector + private key bytes for a domain. The "Internal" suffix is load-bearing: this function does NOT scope by user — it takes a domain name and returns whoever owns that domain's signing key. ONLY call from server-internal codepaths where the domain has alre

(ctx context.Context, domain string)

// treat this as "skip signing" and fall back to whatever the
// relay-level fallback does.
func (s *Store) GetDKIMKeyInternal(ctx context.Context, domain string) (string, []byte, error) {
	norm := normalizeDomain(domain)
	var selector string
	var privKey []byte
	err := s.pool.QueryRow(ctx,
		`SELECT COALESCE(dkim_selector, ''), dkim_private_key FROM domains WHERE domain = $1`,
		norm,
	).Scan(&selector, &privKey)
	if errors.Is(err, pgx.ErrNoRows) {
		return "", nil, nil
	}
	if err != nil {
		return "", nil, fmt.Errorf("dkim key lookup: %w", err)
	}
	der, err := s.unsealDKIM(privKey, norm)
	if err != nil {
		return "", nil, fmt.Errorf("dkim key unseal: %w", err)
	}
	return selector, der, nil
}

// --- Sender identity (decision 4 / Slice 4) ---
//