Related Guides
How to set up SPF records
Complete SPF record setup guide, including syntax explanation and best practices
DANE SMTP Configuration Guide
Configure DANE for SMTP with TLSA records to enforce secure delivery
How to Configure MTA-STS in Cloudflare
Set up MTA-STS policy with Cloudflare for secure SMTP delivery
Microsoft Exchange On-Prem DKIM & DMARC Integration
Enable DKIM signing on Exchange on-prem and publish DMARC for aligned mail.
1 min read
Updated 2025-10-23
Tutorials
exchangedkimdmarcon-prem
Overview: Sign outbound mail with DKIM in Exchange on-prem and publish DMARC to protect your domain.
Prerequisites: Exchange transport role access, DNS zone control, certificate/TLS knowledge.
Steps
- Generate DKIM keys; deploy signer (transport agent or gateway) for Exchange.
- Publish DKIM selector TXT with public key; lower TTL during rollout.
- SPF: include on-prem IP ranges or gateways; end with
-all. - DMARC: publish at
_dmarc; start withp=none, then enforce withpct=.
Verification
- DKIM: DKIM Checker
- Headers: Header Analyzer
- DMARC: DMARC Generator
Troubleshooting
- Transport agent order: ensure DKIM signing occurs after content transforms.
- Edge gateways altering headers: adjust canonicalization or gateway policies.
FAQ
Q: Do I need relaxed canonicalization? A: Prefer relaxed/relaxed unless you fully control all hops.