This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(208, 67%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECS%3C/text%3E%3C/svg%3E)
Hello community,
is it possible to activate DKIM-signing for internal mails?
Current problem:
Internal domain: contoso.com (all mailboxes in EXO - no hybrid)
a@contoso.com sends to test@gmail.com --> Mail is correctly DKIM-signed
a@contoso.com send to b@contoso.com --> no DKIM signature.
Thank you and best regards
Chris
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(41.6, 80%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAL%3C/text%3E%3C/svg%3E)
Just checking in to see how things are going on with this thread.
If the reply was helpful, you can click the "Accept Answer" button under this post so that other's with similar question can benefit from this thread as well.
If you still have further questions or concerns, feel free to post back.
Internal emails are trusted since they are authenticated so no DKIM needed really.
DKIM is only applied at the SMTP gateways that send messages to the internet
We have a third party S/MIME Appliance which signs mails from internal senders with user certificates. Since it's nearly impossible to filter incoming traffic by source ip from exchange online, the appliances uses DKIM to check the authentication of the sender. It would be nice if we could sign internal messages to, but the appliances blocks all mails without dkim-signature.
So the flow would be EXO --> Appliance --> EXO
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(118.4, 28.000000000000004%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EK%3C/text%3E%3C/svg%3E)
DKIM is absolutely needed in split-delivery scenarios, i.e., when messages to some or all "internal" users are handled by an external email system. By the way, this is one of key uses of connectors in Exchange Online.
So, messages transmitted to the external mail server are not DKIM-signed and get rejected or dropped when using recommended DKIM configuration (p=reject).
There absolutely needs to be a way of enabling DKIM signing also for "internal" messages – at least for those that are automatically routed to an external mail exchanger.
DKIM lets you add a digital signature to outbound email messages in the message header.
We can configure DKIM for custom domains manually or Microsoft 365's built-in DKIM configuration.
Detailed steps for configuring DKIM for exchange online can be found in this document: How to use DKIM for email in your custom domain | Microsoft Learn
About “the appliances blocks all mails without dkim-signature”，I recommend that you check whether this device can configure the send domain whitelist.
In addition, you can refer to this document to configure S/MIME in Exchange Online:Configure S/MIME in Exchange Online | Microsoft Learn
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hope things are going well. I am waiting to see if the above information helps. If there's anything else we can help, feel free to let us know.