DMARC pass

Question

In my scenario email will be sent from an application using my subdomain. I want to add my application vendor DKIM in my subdomain, so that DMARC i.e. ( from header ) will pass in emails and they will not treat as spoof. What record will required to add in my DNS. Will it be CNAME or TXT records.

Answer 1

DKIM is typically CNAME. You will add a CNAME to your DNS subdomain that points to their DKIM records

This is similar to how 365 handles it:

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-dkim-configure?view=o365-worldwide

Host name: selector1._domainkey Points to address or value: selector1-<customDomainIdentifier>._domainkey.<initialDomain> TTL: 3600

The magic is the selector - make sure its unique for that DNS zone:

https://ehloergosum.com/2019/08/02/selectors-the-magic-sauce-of-dkim/

You can create a DMARC record for the subdomain or let it use the root domain DMARC record. thats a TXT record

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-dmarc-configure?view=o365-worldwide#set-up-dmarc-for-outbound-mail-from-microsoft-365