You need the private key to sign them, and the public key to validate the signature. Many of the public keys are hard to find now, since it’s been a few years. Many can still be validated, though. More info, an example, and a validator script here: https://github.com/robertdavidgraham/hunter-dkim
Emails can't. The DKIM signatures in mail headers are nigh impossible to fake.
You need the private key to sign them, and the public key to validate the signature. Many of the public keys are hard to find now, since it’s been a few years. Many can still be validated, though. More info, an example, and a validator script here: https://github.com/robertdavidgraham/hunter-dkim