0

My organization has 2 mail servers. One is our MS Exchange server for corporate mail. The other is an SMTP server (not Exchange) our application uses to send automated email notifications to our users. Both servers send from @example.com, though each server has a separate public IP.

I'm wondering if there is a downside to implementing DKIM only for our automated email server (as it seems Exchange doesn't support DKIM out of the box). It's not clear if a partial implementation would hurt mail sent without DKIM.

3 Answers 3

0

As long as you don't publish an ADSP or DMARC record stating that all mail is signed this isn't a problem. The signatures on DKIM signed mail will be verified (and present but bad signatures handled appropriately), and unsigned mail will be processed as usual.

0

It won't hurt mail sent without DKIM. DKIM is an additional check to allow a mail server to verify the authenticity of a message. It is a per message check, and not per domain or mail server check.

If a message signed with DKIM a check is triggered on your DNS records for the DKIM signature. If the message doesn't contain the DKIM-Signature: header it isn't signed and therefore the DNS records won't be checked.

If you implement the header for only one mail server you will be fine, and that mail will have a higher probability of being delivered by some mail services such as Yahoo!

http://www.ietf.org/rfc/rfc6376.txt (RFC6376 3.5)

0

There is no downside as long as recipient does not expect this from all senders (some legal or financial institutions, for example). In addition to what sjdaws has said: you can generate several keys for each server and publish it in DNS under different prefix selectors. This way all mail from your domain will be DKIM-signed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .