Source review dated 8 November 2026. Provider settings and acceptance exercises below are documentary guidance, not executed account, DNS or message tests.
Confirm the product and documentation branch
Mesh's help center limits its Outbound Smarthost workflow to Mesh Gateway and Mesh Unified. Do not assume an inbound-only deployment or a differently packaged product has the same outbound capability. Record the customer tenant, service region, upstream mail platform and any branding or encryption relay. The exact route determines authorization and where signing must occur. Mesh Outbound Smarthost.
The Mesh help center and the Bitdefender-hosted Mesh guide both document optional DKIM key generation. Mesh release 1.7.11 also announces the capability. The Bitdefender guide's statement that a Mesh key is unnecessary is compatible with its optional DKIM keys procedure: organizations can preserve upstream signing or configure a Mesh key when appropriate. Confirm which supported path the customer's deployed service uses rather than interpreting “unnecessary” as “unavailable.” Mesh release 1.7.11 and Bitdefender-hosted outbound guide, DKIM keys.
Optional gateway signing does not require abandoning upstream DKIM. Identify the existing signer and whether its signatures survive the complete route. Inventory mail-flow connectors and exclusions before modifying them. Have an authorized mail administrator and a recovery owner agree how to pause or restore outbound routing without creating a loop.
Enable only the intended outbound route
In the documented Mesh customer workflow, use Customers, Login as, then Settings > Outbound Smarthost to enable Outbound Status and save. The help center advises allowing up to 15 minutes for activation before sending. For Microsoft 365 it points to SPF and connector configuration; for Exchange or other services it asks for public sending-source IP addresses. Follow the current platform-specific connector instructions, including the separate Exclaimer route when applicable. Outbound setup and connector paths.
Do not add broad source ranges merely to make relay access work. Record the actual authorized source and region, and validate that the selected connector sends only the intended traffic. Preserve the previous connector state and any exceptions. A relay accepting submission is not proof that the receiving system will accept the resulting mail or that DMARC will pass.
The connection details page says SPF changes are required when outbound traffic is routed through Mesh. Its EU and US instructions list include:spf1.emailsecurity.app. The Bitdefender guide also lists distinct DTS and OVH region values. Obtain the value for the actual deployed region rather than treating one include as universal. Mesh connection details and Region-specific outbound authorization.
Choose and document the signing path
For upstream signing, confirm the mail platform signs with the intended customer domain and inspect the signature after Mesh and any later relay. The Mesh documentation describes preserving other platforms' signatures, but this is not evidence about every customized downstream transformation. A branding or encryption service may change signed material; test its position in the route.
For optional Mesh signing, first confirm that the deployed tenant exposes the documented DKIM Keys function. Both guides describe choosing a domain, selecting a supported key size of 2048 or 4096, naming a selector, creating the resulting TXT record and using the key edit control to run Check Validation. Use the exact public values issued there and confirm the key's enabled or usable state in the tenant before testing. This article does not assert an undocumented additional activation button or default selection rule. Mesh DKIM Keys procedure and Bitdefender DKIM keys procedure.
Keep selectors unique to the intended signing configuration. Publish no private key, and retain old public keys while messages signed by them may still be in transit. The message's d= and s= values establish which signer and key were actually used. DNS validation cannot prove that a given outbound connector selected that key. DKIM key lookup and verification.
Select the route and record acceptance
Complete one row per material mail path before testing. This blank worksheet is a proposed acceptance aid, not a record of an executed change. Use “none” for an absent intermediary and retain references without credentials.
- Route decision: Mesh product, customer and service region; Intended configuration: ___; Observed after controlled send: ___
- Route decision: Upstream mail platform and connector/rule reference; Intended configuration: ___; Observed after controlled send: ___
- Route decision: Branding or encryption relay and position in chain; Intended configuration: ___; Observed after controlled send: ___
- Route decision: Chosen signing path: upstream, Mesh, or both; Intended configuration: ___; Observed after controlled send: ___
- Route decision: Expected DKIM domain and selector for each signer; Intended configuration: ___; Observed after controlled send: ___
- Route decision: Mesh key validation state, if selected; Intended configuration: ___; Observed after controlled send: ___
- Route decision: Envelope domain and applicable regional SPF authorization; Intended configuration: ___; Observed after controlled send: ___
- Route decision: External sample timestamp and restricted message location; Intended configuration: ___; Observed after controlled send: ___
- Route decision: Received From, Return-Path and SPF domain/result; Intended configuration: ___; Observed after controlled send: ___
- Route decision: Every received DKIM d=, s= and result; Intended configuration: ___; Observed after controlled send: ___
- Route decision: DMARC mode, result and aligned passing path; Intended configuration: ___; Observed after controlled send: ___
For the upstream path, verify the original signature after every configured intermediary. For Mesh signing, also match the observed selector to the tenant's validated key. For both, retain separate results: a failed signature does not erase an independent passing aligned signature. The practical acceptance condition is an intended, passing aligned path on the final message, not merely a count of signatures. DKIM verification and DMARC alignment.
Illustrative diagnosis, not an observed incident: upstream signing succeeds before a branding relay but fails after it changes signed content. Compare the relay order and final signature results before changing keys. A supported signer after the transformation may supply the needed aligned path; confirm that configuration and test it rather than assuming that enabling a second key fixes the route.
At the actual envelope domain, retain one SPF policy and review nested lookup terms. Preserve authorization for legitimate routes that still bypass Mesh. If SPF fails, compare the selected region and final sending host with that policy; an edit at an unrelated root domain cannot repair it. SPF evaluation.
Run a controlled external sample for each worksheet row representing a different path. An internal recipient may not exercise the outbound connector, so it cannot replace the external test. The bound Bitdefender connector instructions explicitly call for an external validation address. Outbound connector validation.
Recover without bypassing security casually
If mail fails after routing changes, compare connector scope, authorized sources, actual region and authentication identities. Roll back only under the agreed mail-flow recovery plan. Do not respond to a quarantine or forwarding edge case by broadly bypassing the smarthost or disabling domain policy. Any exception needs a separate owner, scope and review because it changes the security coverage.
A clean authentication test does not prove filtering efficacy or guarantee delivery. Keep those operational checks separate. Current tenant capability and selected signing path, region-specific records, authoritative DNS, live received-message evidence and human SME approval remain pending. This candidate describes conditional supported paths; it does not certify a deployed Mesh configuration.