Will DKIM cause unsigned messages to bounce?

Question

If DKIM has been configured on a domain (DNS has a TXT record containing a DomainKey), is it necessary to sign all outgoing messages, or is it optional?

I have a domain with a corporate mail server which doesn't sign outbound messages (I don't have any control over this server).

I am adding a web application server which will send outbound messages and I am intending that these messages will be signed.

I am wondering whether adding the DomainKey to DNS will negatively impact deliverability of unsigned messages originating from the corporate mail server.

Is the DKIM verification process on the receiving mail server triggered by the mere presence of the DomainKey in DNS, or is it only activated if an inbound message is signed with DKIM?

Answer 1

DKIM alone will not, it depends on your domain's DMARC policy.

DKIM is the signing mechanism, but does nothing to prevent spoofing on its own. DMARC is what tells domains what to do with messages from you. When implementing DKIM/DMARC, it's best to start in auditing (p=none) mode and see what happens before moving to one of the enforcement (p=quarantine or p=reject) modes.

For more information about DMARC Dmarcian's help pages are those that I've found to be most helpful.

Answer 2

Not having DKIM is a bad practice, as DKIM links a domain to a message and uses cryptography to ensure authorization. If an ISP finds that some of your email are not using DKIM they might decide to send the emails to the spam folder for those msg sent without the signature.