Microsoft Exchange On-Prem DKIM & DMARC Integration

Overview: Sign outbound mail with DKIM in Exchange on-prem and publish DMARC to protect your domain.

Prerequisites: Exchange transport role access, DNS zone control, certificate/TLS knowledge.

Steps

1. Generate DKIM keys; deploy signer (transport agent or gateway) for Exchange.
2. Publish DKIM selector TXT with public key; lower TTL during rollout.
3. SPF: include on-prem IP ranges or gateways; end with -all.
4. DMARC: publish at _dmarc; start with p=none, then enforce with pct=.

Verification

• DKIM: DKIM Checker
• Headers: Header Analyzer
• DMARC: DMARC Generator

Troubleshooting

• Transport agent order: ensure DKIM signing occurs after content transforms.
• Edge gateways altering headers: adjust canonicalization or gateway policies.

FAQ

Q: Do I need relaxed canonicalization? A: Prefer relaxed/relaxed unless you fully control all hops.

Related Tools

Email Health Spam Test