DKIM in Exchange Server 2007/2010/2013/2016/2019 - Tutorial¶

Deploy DKIM Public Key TXT record in Windows DNS Server¶

If your domain is hosted by Windows DNS Server in local LAN. After you added a domain in DKIM Plugin Manager, you can select the domain and click “Deploy Key”, input your DNS server address and choose the DNS zone, the public key will be deployed to DNS server automatically.

If your domain is not hosted by Windows DNS server in local LAN, or it is failed by Deploy Key in DKIM manager, please deploy public key manually as follows:

1. Select and open a domain (e.g. emailarchitect.net) which you want to add a public key record to. Right-click the record list and select “Other New Records…” from the menu.
2. Select the Text (TXT) record type and click the “Create Record…” button.
3. Copy the value (v=DKIM1; k=rsa; p=...) from Public Key field and paste it to the “Text” text box and input s1024._domainkey (depends on the information in the dialog box, the syntax is [selector]._domainkey) in Record Name. Click the OK button.

Note

Windows 2000 DNS Server

If you’re using Windows 2000 DNS server, you should create _domainkey domain under your domain at the beginning, and then create s1024 TXT record under _domainkey sub-domain. The reason is that creating s1024._domainkey TXT record directly is not permitted in Windows 2000 DNS server.

Add DKIM Policy record in Windows DNS Server (Optional*)¶

1. Select and open a domain (e.g. emailarchitect.net) which you want to add a public key record to. Right-click the record list and select “Other New Records…” from the menu.
2. Select the Text (TXT) record type and click the “Create Record…” button.
3. Copy the value (t=y; o=~;) from Policy field and paste it to the “Text” text box and input _domainkey in Record Name. Click the OK button.

Deploy DKIM Public Key TXT in Network Solutions DNS server¶

If your domain is hosted by www.networksolutions.com, you can deploy your public key like this:

1. Select your domain.
2. Select the “Edit TXT Record”.
3. Copy the value (v=DKIM1; k=rsa; p=...) from Public Key field and paste it to the “Text” text box and input s1024._domainkey (depends on the information in the dialog box, the syntax is [selector]._domainkey) in Host. Click the “Continue” button.
4. (optional) Copy the value (t=y; o=~;) from Policy field and paste it to the “Text” text box and input _domainkey in Host. Click the OK button.

Deploy DKIM Public Key TXT in GoDaddy DNS server¶

If your domain is hosted by GoDaddy, you can deploy your public key like this:

1. Select your domain -> “Manage DNS”.
2. Select the Records -> “Add”.
3. Select Type as “TXT”, Copy the value (v=DKIM1; k=rsa; p=...) from Public Key field and paste it to the “TXT Value” text box and input s1024._domainkey (depends on the information in the dialog box, the syntax is [selector]._domainkey) in Host. Click the “Continue” button.
4. (optional) Copy the value (t=y; o=~;) from Policy field and paste it to the “TXT Value” text box and input _domainkey in Host. Click the OK button.

Deploy Public Key TXT in BIND Server or DNS Zone File¶

If your domain is hosted by Bind DNS server, you can add DKIM public key record like this: locate your domain’s zone file and open it with your preferred editor, then add the following content:

; DKIM policy record
_domainkey.yourdomain.com.            IN     TXT    "o=~;"
; DKIM public key record
s1024._domainkey.yourdomain.com.      IN     TXT    "v=DKIM1; k=rsa;p=MIGfMA0GCS....o7QwIDAQAB"

Deploy DKIM Public Key TXT in other DNS server¶

If your domain is hosted by other ISP, as most ISP provide DNS Web administration like “Network Solutions” or “GoDaddy” do, you can refer to Deploy Public Key TXT in Network Solutions DNS server section and deploy your public key in your ISP DNS Web administrative tool.

If you are not DNS server administrator, or your domain is hosted by other DNS server, please send the information in dialog box -> DNS Public Deployment to your domain DNS server administrator for assistant.

2048 Public Key Deployment¶

Because single DNS TXT record is limited to 255 characters, key pair with 2048 length exceeds the limit. You need to separate public key to 2-3 parts in DNS server.

In Windows DNS Server, you should use line-break to separate the long public key

v=DKIM1; k=rsa; p=k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC8YgepDS0lUI3H9dMaQt2Mm...
JTZr1+rjFjkKZV0nYngr/Bv3G1KbqFfp4yDFMUODf9Q/m3OO03GO204kc4CygBQzCKe8BZqzDfHN5rOG...;

In BIND Server or DNS Zone file, you should deploy key as follows:

s1024._domainkey.yourdomain.com.    IN      TXT     ("v=DKIM1; k=rsa; p=MIIBIjANBgkqG9w0BAQEFAAOCAQ8AMIIBCg..."
                                    "2LjDmbvj6V82iSnW3lAg3Sr212oKm7iFAT6diDvItD5botwDpk9jrRFxi...")

;OR

s1024._domainkey.yourdomain.com.    IN      TXT     "v=DKIM1; k=rsa; p=MIIBIjANhkiG9w..." "2LjDmbvj6iSnW3g3Sr212o4..."

Installation Permission¶

When you install DKIM on Exchange Server 2007/2010/2013/2016/2019, please make sure you are using “Domain Administrator” user to run the installer.

Verify Exchange Transport Agent Installation¶

If you installed EA DomainKeys on Exchange 2007/2010/2013/2016/2019, please open Exchange Management Shell and input:

get-transportagent

press enter

Please check if there is EA DomainKeys Agent installed in the output.

If there is no EA DomainKeys Agent, you can re-run the installer directly (do not uninstall) to fix this problem. You can also contact support@emailarchitect.net for assistance.

wrong body hash¶

It is likely that the MTA changed email content (disclaimer software or anti-virus software). Please go to DKIM setting, check Sign a part of message and set Maximum length of message body to sign to zero, then try it again.

Failed to Verify DKIM Signature (wrong body hash, bad signature)¶

If your email has DKIM-Signature header, but it couldn’t be verified by this online tool, you should go to DKIM setting and test your public key again to make sure your public key is ok. If your public key is ok, please contact support@emailarchitect.net for assistance.

Now Exchange Server 2007/2010/2013/2016/2019 can add DKIM signature to outgoing emails from your domain. If you want to send email from other domain, you can simply add the domain from DKIM manager.

In the following section, I will introduce some advanced DKIM features.

DKIM Selector Usage¶

If you have only one server and you only set the DKIM/DomainKeys on this server, you can give your selector any name. For example: your domain name is: emailarchitect.net and your selector is: s1024, you should deploy your public key to s1024._domainkey.emailarchitect.net. After the receiver received your email, the receiver can query the public key from s1024._domainkey.emailarchitect.net to verify your DomainKeys/DKIM signature.

Using a single DKIM selector with the same domain on multiple Exchange servers¶

If all of your servers are running with EA DomainKeys, you should deploy the DKIM as follows:

• Install EA DomainKeys on the first server, and create the domain(s), then open "Dkim Config Folder" by DKIM manager -> DKIM -> Open Config Folder. You can find [domain].json files.
• Install EA DomainKeys on other servers, open "Dkim Config Folder", and copy [domain].json files from first server to other servers’ "Dkim Config Folder".

Now, all of your servers have the same configuration (private/public key pair) for your domain.

Since you use the same configuration file ([domain].json) for the same domain on multiple servers, after you deployed the public key to selector._domainkey.yourdomain, every email from your servers can be verified by the public key.

Using multiple DKIM selector with the same domain on multiple Exchange servers¶

If you don’t want to copy the configuration files to all servers or you have another server signing the DomainKeys/DKIM with the key pair/private key not supported by EA DomainKeys, you can use different selector for different server.

For example, there have two server named server1 and server2, On the first server (server1), svr1 is used as the selector. On the second serve (server2), svr2 is used as the selector. The two servers use different key pairs (private key).

Two public key records should be deployed: deploy the first server public key to svr1._domainkey.yourdomain; deploy the second server public key to svr2._domainkey.yourdomain.

• When an email is sent from the first server, the email is signed by the key pair (private key) on this server and the receiver will query the public key from svr1._domainkey.yourdomain to validate the DKIM signature.
• When an email is sent from the second server, the email will be signed by the key pair (private key) on this server and the receiver will query the public key from svr2._domainkey.yourdomain to validate the DKIM signature.

This is how selector provide a solution for using different key-pair/private key with the same domain on multiple servers.

This solution doesn’t require you to copy the configuration files to all servers, nor it require all of your servers to run EA DomainKeys. You just need to create different selector for different servers, and deploy multiple public key based on selector.

How to use Sender Rule¶

Here is the scenario. You own a domain emailarchitect.net and you have DKIM/DomainKeys for emailarchitect.net set on your server. There is no problem when you send emails with sender *@emailarchitect.net, the email will be signed correctly.

At the same time, your customer requested you to send emails with sender *@adminsystem.com and sign the DKIM/DomainKeys signature for outgoing emails. As adminsystem.com is your customer domain and you don’t have permission to deploy the public key to adminsystem.com DNS server, you have to use sender rule.

To solve the problem, you can add a sender rule like the above screenshot. This rule means “If from addess is *@adminsystem.com, then add a sender header (Sender: testuser@emailarchitect.net) to the message”. And the email will be signed by emailarchitect.net based on the sender header.

With the above sender rule, the email will be signed by DomainKeys/DKIM signature with domain emailarchitect.net. And the recipient email client will display: From: testuser@emailarchitect.net on behalf of *@adminsystem.com.

Use Reply-To header instead of Sender header¶

If you also check “Use Reply-To header instead of Sender header”, and the recipient email client will display:

Reply-To: *@adminsystem.com (original sender address)
From: testuser@emailarchitect.net

We strongly suggest that you use this option for anti-spam policy.

DKIM Priority¶

DKIM setting has higher priority than sender rule, that means if DKIM setting is found for the email, this email will not be changed by sender rule.

For example, if you set emailarchitect.net in DKIM setting, and add a rule like this:

if From contains *@emailarchitect.net,
    then ...

Sender rule won’t change the email sender from *@emailarchitect.net, the email will be simply signed by DKIM with emailarchitect.net.