This is an interesting idea, and I had to consider for a few moments whether there would be flaws, but there are.
(plain) DNS is insecure
You already realized this, but you could verify DNSSEC signatures to prevent faked DNS entries. Pinning might be viable, but what to do in case of keys changed in purpose?
DKIM signs the domain, not users
Quoating RFC 6376, DomainKeys Identified Mail (DKIM) Signatures,
DomainKeys Identified Mail (DKIM) permits a person, role, or organization that owns the signing domain to claim some responsibility for a message by associating the domain with the message.
Lots of mail servers only verify user's credentials when accepting submitted mails, and not the sender address. This means for the mail provider example.net, you can sign in as [email protected] and send mails as [email protected] (which would result in a correct DKIM signature), often also for other domains like [email protected] (which would result in a broken or none DKIM signature). You can set the From: field rather arbitrarily, and that's not even something mail servers are supposed not to be allowing.
DKIM only guarantees valid sending servers, not permitted sending users. It is meant to prevent fake servers to send mails, which is the most common source of spam messages.
Multiple users might be able to send from a given mail address
There are use cases where multiple people can sent from a given address, but are not allowed to receive messages. Use cases might for example be:
- support systems, where a unique sender address is used, but internally tickets are routed to the specific operators
- newsletter systems and similar operation modes where there are operators allowed to send mail (and have valid DKIM records for their own servers), but should not receive feedback
- mailing lists
If DKIM would verify users, the proposed schema would allow those senders to get keys signed, although they are not intended recipient. This might be an issue, and might not be, but would require further definition of what the certification describes. The common understanding is rather a validation of recipients.
