dkim_patterns verifiedcriticalWritten by the Hub
Which messages a key signs
Matches a key to messages by sender address, with five match types: exact, regular expression, substring, wildcard, global.
In detail
Three columns, and the whole difference between a key that works and a key that does not. Nothing warns when a key has no pattern: it sits in the list looking complete while messages leave unsigned. The match is on the sender address, so one node can sign different domains with different keys — and a global pattern signs everything, which is the shape a single-tenant node usually wants.