FWIW, I would just use the dkim verify function for this, at reception time. It returns an array of authentication results and you can look inside that for specific domains and use that to reject at reception time. The cost of this is not going to be significant, and the latency of it is likely less than calling out over the network to redis. Eliminating a storage system makes the architecture simpler, which makes it less likely to break.
I know that sending time can theoretically catch issues where things expire post-reception, but the window of opportunity for sending out messages with expired signatures is bounded by the maximum age you’ve set for messages in the queue (eg: typically 1 week). Since most messages are relayed “immediately”, the bulk of things that remain in-queue are unlikely to be successfully delivered anyway.