Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My organization has 2 mail servers. One is our MS Exchange server for corporate mail. The other is an SMTP server (not Exchange) our application uses to send automated email notifications to our users. Both servers send from, though each server has a separate public IP.

I'm wondering if there is a downside to implementing DKIM only for our automated email server (as it seems Exchange doesn't support DKIM out of the box). It's not clear if a partial implementation would hurt mail sent without DKIM.

share|improve this question
up vote 0 down vote accepted

As long as you don't publish an ADSP or DMARC record stating that all mail is signed this isn't a problem. The signatures on DKIM signed mail will be verified (and present but bad signatures handled appropriately), and unsigned mail will be processed as usual.

share|improve this answer

It won't hurt mail sent without DKIM. DKIM is an additional check to allow a mail server to verify the authenticity of a message. It is a per message check, and not per domain or mail server check.

If a message signed with DKIM a check is triggered on your DNS records for the DKIM signature. If the message doesn't contain the DKIM-Signature: header it isn't signed and therefore the DNS records won't be checked.

If you implement the header for only one mail server you will be fine, and that mail will have a higher probability of being delivered by some mail services such as Yahoo! (RFC6376 3.5)

share|improve this answer

There is no downside as long as recipient does not expect this from all senders (some legal or financial institutions, for example). In addition to what sjdaws has said: you can generate several keys for each server and publish it in DNS under different prefix selectors. This way all mail from your domain will be DKIM-signed.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.