diff --git a/assets/policy-extras/dkim_sign.lua b/assets/policy-extras/dkim_sign.lua
index 00fdfcd1..cf11e6ad 100644
--- a/assets/policy-extras/dkim_sign.lua
+++ b/assets/policy-extras/dkim_sign.lua
@@ -19,7 +19,7 @@ local SignatureSigningPolicy =
 local SigningAlgo = typing.enum('SigningAlgo', 'sha256', 'ed25519')
 
 local DkimSignConfig = Record('DkimSignConfig', {
-  base = Record('DkimSignConfig.Base', {
+  base = Option(Record('DkimSignConfig.Base', {
     vault_mount = Option(String),
     vault_path_prefix = Option(String),
     additional_signatures = Option(List(String)),
@@ -29,9 +29,9 @@ local DkimSignConfig = Record('DkimSignConfig', {
     header_canonicalization = Option(String),
     body_canonicalization = Option(String),
     over_sign = Option(Bool),
-  }),
+  })),
 
-  domain = typing.map(
+  domain = Option(typing.map(
     String,
     Record('DkimSignConfig.Domain', {
       selector = Option(String),
@@ -43,7 +43,7 @@ local DkimSignConfig = Record('DkimSignConfig', {
       body_canonicalization = Option(String),
       over_sign = Option(Bool),
     })
-  ),
+  )),
 
   signature = Option(typing.map(
     String,
@@ -129,7 +129,11 @@ domain = "myesp.com"
 ]]
 
 local function load_dkim_data_from_file(file_name, target)
-  local data = DkimSignConfig(utils.load_json_or_toml_file(file_name))
+  local raw_data = utils.load_json_or_toml_file(file_name)
+  local is_ok, data = pcall(DkimSignConfig, raw_data)
+  if not is_ok then
+    error(string.format("reading data from file '%s': %s'", file_name, data))
+  end
 
   if data.base then
     utils.merge_into(data.base, target.base)
diff --git a/docs/changelog/main.md b/docs/changelog/main.md
index 6997fb12..5a4483f6 100644
--- a/docs/changelog/main.md
+++ b/docs/changelog/main.md
@@ -40,3 +40,7 @@
   `0ns` for sessions for which we had not observed the session opening. Now we
   will assume a start time time of the first record observed for a session, so
   that some sense of relative time can be gleaned from the trace output.
+
+* When using the dkim helper and splitting the configuration
+  across multiple files, a missing `domain` or `base` configuration section in
+  any individual file would raise a validation error.