[ Platform guides ]

Exchange Server DKIM: identify the component that performs outbound signing

Find the actual outbound signer for Exchange Server instead of applying Exchange Online commands to the wrong system.

By the EmailAuth research team · 3 min read

[ Key points ]

  • Find the actual signing component after message transformations.
  • Cloud cmdlet documentation does not establish an on-premises capability.
  • Require current compatibility evidence before adopting a transport agent.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Require current compatibility evidence before adopting a transport agent.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Keep operational evidence

Trace every connector and transformation. Verify the signature at the recipient after the final egress, including relay and failover paths.

Next steps

  1. Trace every connector and transformation.
  2. Verify the signature at the recipient after the final egress, including relay and failover paths.
  3. Include the failover connector in acceptance tests.

CISO / SecOps

Review the trust boundary

Require support and rollback evidence before installing transport components. Protect signing keys and retain a domain-authorisation record.

Next steps

  1. Require support and rollback evidence before installing transport components.
  2. Protect signing keys and retain a domain-authorisation record.
  3. Review transport-agent upgrade risk.

Founder / Non-technical

Own the business decision

Fund a supported signing boundary and its maintenance, not just a DNS task. Make ownership explicit across Exchange and gateway teams.

Next steps

  1. Fund a supported signing boundary and its maintenance, not just a DNS task.
  2. Make ownership explicit across Exchange and gateway teams.
  3. Require a supported Exchange build plan.

[ FAQs ]

Frequently asked questions

Can New-DkimSigningConfig configure my on-premises server?

Microsoft documents it as cloud-service-only. Identify the actual signing component rather than assuming the cmdlet applies to Exchange Server.

Microsoft New-DkimSigningConfig

Does a DKIM DNS record cause Exchange to sign?

No. A configured signer must create the signature; DNS supplies the corresponding public verification material.

Should I install the community signing agent?

Only after evaluating current compatibility, maintenance and recovery for your exact build. The checked README retains a May 2023 request for someone to continue development; its historical compatibility list is not a current support commitment.

Exchange DKIM Signer project documentation

Can Microsoft 365 sign mail originating on-premises?

Where the supported route actually passes through the configured cloud service, verify the tenant signing configuration and a received message from that route.

Microsoft: configure DKIM for custom domains

Where should disclaimers be added?

Prefer a design in which required transformations occur before the final aligned signature. Prove the actual behaviour with received samples.

Why test application relay separately?

It may use a different connector or egress and bypass the signer used by ordinary mailbox messages.

What is a safe rotation sequence?

Publish the new public material, activate and verify the new signer, then retire old material after checking active and in-flight dependencies.

What must the rollback preserve?

Delivery availability, connector restrictions and a known signing path. Save configuration and test recovery before introducing agent or routing changes.

[ Sources ]

Sources

  1. Microsoft New-DkimSigningConfig

    Sections Description and cloud-service-only applicability

  2. Microsoft: configure DKIM for custom domains

    Sections Configure DKIM signing of outbound messages · Verify DKIM signing

  3. Exchange DKIM Signer project documentation

    Sections README: installation, configuration and supported versions

  4. RFC 6376: DKIM

    Sections §3.5 The DKIM-Signature Header Field · §3.6 Key Management

  5. RFC 9989: DMARC

    Sections §4.4 Identifier Alignment Explained · §5 DMARC Policy

[ Glossary ]

Glossary

Aligned authentication
A passing SPF or DKIM identity that meets the applicable relationship to the visible From domain.
Authoritative DNS
The DNS service responsible for publishing records for a zone.
Signing boundary
The component and point in the outbound route that applies a signature after the intended message transformations.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base