IIS SMTP Server is a common Windows built-in SMTP service. DKIM is a method for associating a domain name to an email message, thereby allowing email sender claims some responsibility for the email. In this topic, I will introduce how to add DKIM signature to outgoing emails in IIS SMTP server. I will also introduce DKIM selector and sender rule usage.

How DKIM works?

DKIM combines of a public key cryptography and a DNS to provide credible domain-level authentication for email.

When an email claims to originate from a certain domain, DKIM provides a mechanism by which the recipient system can credibly determine that the email did in fact originate from a person or system authorized to send email for that domain.

Therefore, to sign an email with DKIM in IIS SMTP Server, you MUST have a private key/public key pair for email signing. The work flow is illustrated as follows:


Because DKIM signer uses private key to sign the email, recipient system uses public key to verify the signature, therefore, if signer doesn't expose the private key to third-party, the DKIM signature cannot be faked.

Here is a nice HTML version for this topic:
https://www.emailarchite...ys/kb/dkim_iis_smtp.aspx

Edited by user Thursday, January 12, 2017 8:49:53 PM(UTC)  | Reason: Not specified

Create DKIM for Domain

Click "Domainkeys/DKIM" in Manager and click "New" to create a new domain DKIM signature. DKIM signature is based on the domain of sender email address. It is nothing about the server name. For example, if you want to sign the email from *@emailarchitect.net, please input emailarchitect.net to Sender Domain.

Certificate for Key Pair

You don’t have to use certificate issued by third-party authorities, I strongly recommend that you use DKIM manager to generate certificate automatically.​​​​​​​



You can simply input your sender domain, use default settings for other parameters, finally click "Save" to create your DKIM signature.

Here is the detailed information about DKIM parameters:

DomainKeys/DKIM Parameters:

Sender Domain:
DomainKeys/DKIM signature is based on the domain of sender email address. It is nothing about your server name. For example, if you want to sign the email from *@emailarchitect.net, please input emailarchitect.net to Sender Domain.

Selector:
To support multiple concurrent public keys per sending domain, the DNS namespace is further subdivided with "selectors". Selectors are arbitrary names below the "_domainkey." namespace. To learn more detail, please refer to Selector section. For a new domain, you can simply use the default value "s1024".

Active:
If you have this option unchecked, DomainKeys/DKIM for this domain will be disabled.

Signature:
Default value is: Both DKIM and DomainKeys. You can also choose "DKIM Only" or "DomainKeys Only". We strongly recommend that you select "Both DKIM and DomainKeys".

Canonicalization Algorithm:
nofws/relaxed is recommended and it has better compatibility.

DKIM Signature Algorithm:
On Windows 2000/2003/XP, rsa-sha1 is the only option. On windows vista/7/2008 or later version, you can choose "rsa-sha1" or "rsa-sha256". "rsa-sha1" gives better performance while "rsa-sha256" is more secure. "rsa-sha1" is recommended.

Certificate File Name/Password/Type:
If you don't have a certificate (private/public key pair) for your domain, DKIM manager will create a certificate for your domain automatically; if you have an existed certificate, please import it from your local disk and input your certificate protection password.

If you choose "you don't have a certificate...", DKIM manager will try to create a certificate from your local machine automatically. If the operation fails, DKIM manager will download a certificate from our server remotely.
If you have another server using our DKIM software to sign the same domain and it uses the same selector, you need to copy the certificate from that server and use the same certificate. Please refer to: Deploy DomainKeys/DKIM on multiple servers with same domain.

If you have another server not using our DKIM software to sign the same domain, please select "I don't have a certificate ...", and use a different selector. To learn more detail, please refer to Selector section.

Signed Headers:
Specify what message headers should be signed. "sender" header and "from" header are a MUST. Using default setting is recommended.

Edited by user Thursday, January 12, 2017 8:47:24 PM(UTC)  | Reason: Not specified

As I introduced "how DKIM works", the recipient mail system need to query public key to verify DKIM signature. So we need to deploy DKIM public key to domain DNS server, then recipient system can query it by DNS server. Now we get back to DKIM manager and select your domain and click "Export Public Key":

Deploy Public Key by DKIM Manager

If your domain is hosted by Windows DNS Server in local LAN. After you added a domain in DKIM Plugin Manager, you can select the domain and click "Deploy Key", input your DNS server address and choose the DNS zone, the public key will be deployed to DNS server automatically.



Deploy DKIM Public Key Manually

If your domain is not hosted by Windows DNS server in local LAN, or it is failed by "Deploy Key" in DKIM manager, you can select the domain and click "Export Public Key". A dialog box will pop up and display a Public Key and a TXT record for deployment in your DNS server.




Here is record detailed information:

TXT Record:
The full name of your public key record.

Public Key:
The value in the record.
Test Mode
"t=y;" in public key record means Test mode, you can remove "t=y;" from your public key record after your DKIM/DomainKeys test is finished.

Domain Policy Record (Optional):
Domain Policy Record is always deployed to _domainkey.yourdomain. In policy record value, o = Outbound Signing policy ("-" means that this domain signs all email; "~" is the default value and means that this domain may sign some email with DomainKeys). If you do not set policy record, the o=~; is used by default.

Edited by user Monday, July 6, 2015 6:11:37 PM(UTC)  | Reason: Not specified

Deploy DKIM Public Key TXT in Network Solutions DNS server or Bind DNS server

If your domain is hosted by www.networksolutions.com, you can deploy your public key like this:

Step 1: Select your domain

Step 2: Select the "Edit TXT Record.

Step 3: Copy the value (t=y; k=rsa; p=...) from Public Key field and paste it to the "Text" text box and input "s1024._domainkey" (depends on the information in the dialog box, the syntax is [selector]._domainkey) in Host. Click the "Continue" button.

Step 4 (optional*): Copy the value (t=y; o=~;) from Policy field and paste it to the "Text" text box and input "_domainkey" in Host. Click the OK button.



Deploy DKIM Public Key TXT in other DNS server

If your domain is hosted by other ISP, as most ISP provide DNS Web administration like "network solutions" do, you can refer to "Deploy Public Key TXT in Network Solutions DNS server" section and deploy your public key in your ISP DNS Web administrative tool.

If you are not DNS server administrator, or your domain is hosted by other DNS server, please send the information in dialog box->DNS Public Deployment to your domain DNS server administrator for assistant.

Edited by user Monday, July 6, 2015 6:15:09 PM(UTC)  | Reason: Not specified

Test DKIM

Now you can have a test with this online tools again:

First of all, open http://www.appmaildev.com/en/dkim

Click "Next Step", you will get a test email address like this:



Finally you can send an email to this email address from IIS SMTP Service, please make sure your sender address is belong to this domain, otherwise, DKIM signature won't be signed. A DKIM report will be generated in a short time.

You will get a report like this:



If you get "DKIM Result: pass" in report email, that means your DKIM signature is verified successfully. If there is any error, please have a look at following section

Edited by user Thursday, January 12, 2017 8:49:11 PM(UTC)  | Reason: Not specified

DKIM Selector

To support multiple concurrent public keys per sending domain, the DNS namespace is further subdivided with "selectors". Selectors are arbitrary names below the "_domainkey." namespace. For example, selectors may indicate the names of your server locations (e.g., "mta1", "mta2", and "mta2"), the signing date (e.g., "january2005", "february2005", etc.), or even the individual user.

The most important thing is: selector indicates your DKIM public key location. For example: if your domain selector is: "s1024", your public key record will be "s1024._domainkey.yourdomain"; if your domain selector is: "mta1", your public key record will be "mta1._domainkey.yourdomain".

DKIM Selector Usage

If you have only one server and you only set the DKIM/DomainKeys on this server, you can give your selector any name. For example: your domain name is: "emailarchitect.net" and your selector is: "s1024", you should deploy your public key to "s1024._domainkey.emailarchitect.net". After the receiver received your email, the receiver can query the public key from "s1024._domainkey.emailarchitect.net" to verify your DomainKeys/DKIM signature.

If you have only one IIS SMTP server, you can skip the followng sections.

Edited by user Sunday, July 7, 2013 7:04:30 PM(UTC)  | Reason: Not specified

Using multiple DKIM selectors with the same domain on multiple IIS SMTP servers

If you don't want to copy the certificate to all servers or you have another server signing the DKIM with the key pair certificate not supported by EA DomainKeys, you can use different selector for different server.



For example, there have two server named “server1” and “server2”, On the first server (server1), "svr1" is used as the selector. On the second serve (server2), "svr2" is used as the selector. The two servers use different key pairs (certificate).

Two public key records should be deployed: deploy the first server public key to svr1._domainkey.yourdomain; deploy the second server public key to svr2._domainkey.yourdomain

When an email is sent from the first server, the email will be signed by the key pair (certificate) on this server and the receiver will query the public key from svr1._domainkey.yourdomain to validate the DKIM signature.

When an email is sent from the second server, the email will be signed by the key pair (certificate) on this server and the receiver will query the public key from svr2._domainkey.yourdomain to validate the DKIM signature.

This is how “selector” provide a solution for using different key-pair/certificates with the same domain on multiple servers.

This solution doesn't require you to copy the certificate to all servers, nor it require all of your servers to run EA DKIM. You just need to create different selector for different servers, and deploy multiple DKIM public key based on selector.

Finally, I will introduce how to sign DKIM onbehalf customer domain.

Edited by user Monday, July 6, 2015 6:18:51 PM(UTC)  | Reason: Not specified

The end.

Any questions, comments and discuss for DKIM in IIS SMTP Service is welcome.

Edited by user Monday, July 8, 2013 2:52:50 AM(UTC)  | Reason: Not specified

July 2, 2015
DomainKeys/DKIM for IIS SMTP Service and Exchange Server 3.2

Deployment Tool for Windows DNS Server;

SPF Record Tool;
DMARC Record Tool

Advanced options for DKIM length and Sender Rule.