The email authentication method that uses a digital signature in the header is DKIM.
DomainKeys Identified Mail adds a `DKIM-Signature:` header to an outgoing message. The signing mail system uses a private key to sign selected headers and the message body, usually after calculating a cryptographic body hash. The receiving system reads the domain and selector in the signature, then retrieves the matching public key from a DNS TXT record such as `selector._domainkey.example.com`.
A valid signature indicates that the identified signing domain accepted responsibility for the message and that signed content was not altered in transit. DKIM does not necessarily prove that the human sender is trustworthy, and a failed signature does not automatically require rejection; receiving systems use the result with other reputation and policy signals.
SPF is the main source of confusion. SPF checks whether the connecting server is authorized by DNS, while DKIM authenticates a signed message. DMARC builds on SPF and DKIM by applying policy and checking domain alignment with the visible `From:` address. S/MIME is a separate user-focused system for signing or encrypting mail.